Shibboleth restricted authentication to Box.

[Cantor, Scott]

> We would like to also limit the authentication to Box for certain users
> within our domain via Shibboleth using Active directory multi value
> attributes such as (otherIpPhone attribute).
> 
> How can we achieve this from the IDP side ?  Has anyone done similar
> configuration in their environment ? Any help is greatly appreciated.

We do not encourage that approach, but the context-check intercept flow can block request processing based on attributes and other criteria.

https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration

You should instead be using some kind of attribute-based access control with Box.

-- Scott