Using isMemberof Attribute to release specific group membership

[Wessel, Keith]

>From my experience, it makes sense to release all values that the service provider might potentially be interested in, then let the SP decide what to do with it. In your case, I'd release all three possible values to the SP and let it give access based on the highest possible value.

Seems like, to do it from the IDP, you'd need to invent a new attribute (it could have the same oid as isMemberOf) and populate it with the highest possible group using a scripted attribute definition. This is more complex and less elegant, though, then just letting the SP make the decision.

Keith


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Michael Richter
Sent: Wednesday, March 30, 2016 11:53 AM
To: users at shibboleth.net
Subject: Using isMemberof Attribute to release specific group membership

Hello all, 
    I'm trying to do something that should be (and may be) easy.  I'm still new to Shibboleth and may be missing something, but I've spent the last day trying to figure this out.   

I need to release a group membership based on specific criteria.  Basically we have a site that has 3 levels of access,  CompSci, Faculty, Staff (from highest privileged to least).  I'd like to release the group membership that matches the highest privilege the user is entitled to.  Below is where I am 

I have my attribute resolver populating the isMemberOf attribute with a list of all groups the user is a member of.   Then in my attribute-filter.xml I use the following rule to release the group name. 

<AttributeRule attributeID="isMemberOf">
             <PermitValueRule xsi:type="Value" value="CN=Staff,OU=Groups,DC=coastal,DC=edu"/>
</AttributeRule>

This sends the single group membership.  This would work if I was looking for a single group, but I need to prioritize.  Is it possible in the Attribute filter to set a rule to try to match the "CompSci" group first and then stop if it is found, but if it is not found then move on to the next rule that will try to match the "Faculty" group and send it if found.  This would allow me to only send the group that has highest level of privileges allowed to the user. 

Any help would be appreciated.  Thanks! 

Mike Richter


Mike Richter
ITS System Administrator
Coastal Carolina University