Can Shib 3 deny access to certain SPs based on a user attribute?

[Cantor, Scott]

On 10/15/15, 11:36 AM, "users on behalf of Jessica Coltrin" <users-bounces at shibboleth.net on behalf of jcoltrin at pdx.edu> wrote:

>Can Shib 3 deny access to certain SPs based on a user attribute? Our use case is that we want former students who are not currently active to have access to only certain SPs and we'd like to control that with Shibboleth based in an attribute indicating status. Is this possible? If not, how do others handle this use case?

Everything that's been said is correct, but yes, V3 has this feature, it's a "profile intercept" called the context-check intercept and there are examples in the config files on using it to block based on attributes. It's not a documented feature at this point (it's supported, just not well documented). There are threads in the archive on it.

-- Scott