IdP v3 intercept flow that restricts /some/ users

[Cantor, Scott]

On 6/11/15, 2:02 PM, "Liam Hoekenga" <liamr at umich.edu> wrote:


>
>I'm trying to figure out how to replicate this with an intercept flow.  
>The example intercept flow allows access to users with an ePPN trying to 
>access a specific SP.
>
>I need something that denies access to users with a specific attribute 
>value, unless they're trying to access an SP that's on the list.

The intercept flow is just a predicate container, the example is not 
entirely the flow, but the predicate/condition it happens to be using. The 
condition bean that the flow runs is called 
shibboleth.context-check.Condition, so whatever you define that bean to do 
is what the flow is doing.

You can write any condition you want either in Java or with a Script (a 
ScriptedPredicate exists). Your specific use case would I guess be to 
check an attribute's value in an AND with a set of OR'd together SP names.


Of course, if you need to have different flows doing different checks, 
that still means creating a separate flow copy, but in terms of how to 
implement any specific check, it's just a matter of what that condition 
bean does.

-- Scott