Restrict attribute values based on SP entity?

[Brian Mathis]

@Scott
I didn't mean to imply anything about the documentation being light,
just that I had read what was there and needed more guidance.

@Peter
Thanks for your help, it put me on the right track.  Turns out I was
getting bit by missing xml namespace qualifiers on my
{Permit,Deny}ValueRules (doh!).

This is what worked for me:

    --- attribute-policy.xml.dist
    +++ attribute-policy.xml
    @@ -59,6 +59,11 @@
                <afp:PermitValueRule xsi:type="saml:NameIDQualifierString"/>
            </afp:AttributeRule>

    +        <!-- Deny uid unless allowed below -->
    +        <afp:AttributeRule attributeID="uid">
    +            <afp:DenyValueRule xsi:type="ANY" />
    +        </afp:AttributeRule>
    +
            <!-- Catch-all that passes everything else through unmolested. -->
            <afp:AttributeRule attributeID="*">
                <afp:PermitValueRule xsi:type="ANY"/>
    @@ -66,4 +71,11 @@

        </afp:AttributeFilterPolicy>

    +    <afp:AttributeFilterPolicy id="allow-uid-for-entity-xxxxx">
    +        <afp:PolicyRequirementRule
xsi:type="AttributeIssuerString" value="xxxxx" />
    +        <afp:AttributeRule attributeID="uid">
    +            <afp:PermitValueRule xsi:type="AttributeValueString"
value="abc" />
    +        </afp:AttributeRule>
    +    </afp:AttributeFilterPolicy>
    +
     </afp:AttributeFilterPolicyGroup>


~ Brian


On Tue, Nov 15, 2016 at 6:18 PM, Peter Schober
<peter.schober at univie.ac.at> wrote:
> * Brian Mathis <brian.mathis at gmail.com> [2016-11-15 17:56]:
>> I've tried various combinations of AttributeFilterPolicies and
>> AttributeRules, but they all seem to either allow everything or block
>> everything.  I'm starting from the default attribute-policy.xml
>> file.
>
> Here's a slighly simpler example I've used in the past: Accepting the
> "uid" attribute only from a specific IDP, and rejecting all uid
> attributes from anywhere else:
>
> In its own rule, near the end of the file policy file (you could amend
> that with more specific rules about the values) I accept any uid from
> this IDP:
>
>     <afp:AttributeFilterPolicy>
>         <afp:PolicyRequirementRule xsi:type="basic:AttributeIssuerString" value="https://idp.example.org/shibboleth" />
>         <afp:AttributeRule attributeID="uid">
>             <afp:PermitValueRule xsi:type="ANY"/>
>         </afp:AttributeRule>
>     </afp:AttributeFilterPolicy>
>
> Then within the existing always-runs rule near the top:
>
>     <afp:AttributeFilterPolicy>
>         <!-- This policy is in effect in all cases. -->
>         <afp:PolicyRequirementRule xsi:type="ANY"/>
>
> I added a deny rule to deny "uid" from everywhere:
>
>     <!-- Deny acceptance of uid attribute BUT allow it from specific IDPs elsewhere -->
>     <afp:AttributeRule attributeID="uid">
>         <afp:DenyValueRule xsi:type="ANY"/>
>     </afp:AttributeRule>
>
> right before the "catch-all" that accepts everything else (for
> clarity, order doesn't atter otherwise):
>
>     <!-- Catch-all that passes everything else through unmolested. -->
>     <afp:AttributeRule attributeID="*">
>         <afp:PermitValueRule xsi:type="ANY"/>
>     </afp:AttributeRule>
>
> HTH,
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net