AccessRule Not Working

[Peter Schober]

* Teresa Fasano <t.fasano at cineca.it> [2016-08-05 15:39]:
> I need to set an access rule on my SP service to disable access to
> users having the profile as a student.

Note that that's not a good rule, as everyone without that profile
would be allowed, even those without any attributes.

Also note that a custom attribute "profile" with values like
"STUDENTE" sounds suspiciously like you'd better use international
standard attribtues for that, here eduPerson/(Scoped)Affiliation.

> The rule should only be applied to a specific path:
> <Host name="myurl" authType="shibboleth" requireSession="true"
[...]

Furthermore note that since you wrote:

> In the config file of Apache I have:

there should be no reason to use the XML-based access control, as
that's all done easier in Apache httpd. httpd 2.4 has it's own complex
ACLs with boolean logic, but the Shib SP provides a custom syntax for
httpd 2.2, too.

> Seems rights but the rule has no effect: students enter in the
> application.

Raise the logging for the native log to DEBUG to see what the web
server thinks of the request and whether it matches what you think.
But better to move that to httpd config. The documentation has
examples of NOT rules, too.
-peter