Shibboleth restricted authentication to Box.

[Andrew Morgan]

On Thu, 31 Mar 2016, Cantor, Scott wrote:

>> We would like to also limit the authentication to Box for certain users
>> within our domain via Shibboleth using Active directory multi value
>> attributes such as (otherIpPhone attribute).
>>
>> How can we achieve this from the IDP side ?  Has anyone done similar
>> configuration in their environment ? Any help is greatly appreciated.
>
> We do not encourage that approach, but the context-check intercept flow can block request processing based on attributes and other criteria.
>
> https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration
>
> You should instead be using some kind of attribute-based access control with Box.

We only release attributes to Box if the person is Box-eligible.  Here is 
our attribute-filter.xml section for Box:

     <!-- box filters -->
     <AttributeFilterPolicy id="box">
         <PolicyRequirementRule xsi:type="AND">
             <Rule xsi:type="Requester" value="https://services.box.com/sp" />
             <Rule xsi:type="Value" attributeID="box_eligible" value="1" />
         </PolicyRequirementRule>
         <AttributeRule attributeID="eduPersonPrincipalName">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="surname">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="givenName">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>
     <AttributeFilterPolicy id="box-deny">
         <PolicyRequirementRule xsi:type="AND">
             <Rule xsi:type="Requester" value="https://services.box.com/sp" />
             <Rule xsi:type="NOT">
                 <Rule xsi:type="Value" attributeID="box_eligible" value="1" />
             </Rule>
         </PolicyRequirementRule>
         <AttributeRule attributeID="eduPersonPrincipalName">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="eduPersonPrincipalNamePrior">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="eduPersonTargetedID">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="eduPersonPrimaryAffiliation">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="eduPersonAffiliation">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="eduPersonScopedAffiliation">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="email">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="commonName">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="surname">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="givenName">
             <DenyValueRule xsi:type="ANY" />
         </AttributeRule>
     </AttributeFilterPolicy>


 	Andy