Attribute checking based on sp location

[Peter Schober]

* SAMUELE RILLI <samuele.rilli at unicam.it> [2016-10-14 11:13]:
> I set up a Shibboleth SP 2.5.4.
> I need to protect some sp locations by doing attribute checking (and
> eventually removing the session), but I need to check different attributes
> and different values according to specific sp locations.
> For example, /account location may be accessed by any logged user, but
> /admin must be accessed only by a logged user with specific attribute(s).
> 
> However, as far as I can understand, AttributeChecker handler and
> sessionHook allow me to remove the session with flushSession, but they
> always check all the attributes no matter the location.
> Is it possible to specify different rules for different locations
> with AttributeChecker? Alternatively, a custom sessionHook could enable me
> to do that?

You'd use "ordinary" access control in the web server instead
of the AttributeChecker, so <Location /account> would have the usual
require directives, /admin would have additional restrictions, etc.
-peter