Attribute checking based on sp location

[SAMUELE RILLI]

Thanks for the answers,
yes, currently I'm using Apache config.
This scenario is tricking me: a user logs in as a non-admin account to
/account,
then if he moves to /admin a 403 Forbidden error is generated (as expected).
In the latter case I need to remove the sp session and trigger a new
authentication for /account which will allow the user to access the
resource... but how to do that without using flushSession?
I know I can set a custom 403 page through Apache ErrorDocument, but can I
remove sp session from there, then redirect back to the forbidden location
to trigger a new authn request?

2016-10-14 15:26 GMT+02:00 Peter Schober <peter.schober at univie.ac.at>:

> * SAMUELE RILLI <samuele.rilli at unicam.it> [2016-10-14 11:13]:
> > I set up a Shibboleth SP 2.5.4.
> > I need to protect some sp locations by doing attribute checking (and
> > eventually removing the session), but I need to check different
> attributes
> > and different values according to specific sp locations.
> > For example, /account location may be accessed by any logged user, but
> > /admin must be accessed only by a logged user with specific attribute(s).
> >
> > However, as far as I can understand, AttributeChecker handler and
> > sessionHook allow me to remove the session with flushSession, but they
> > always check all the attributes no matter the location.
> > Is it possible to specify different rules for different locations
> > with AttributeChecker? Alternatively, a custom sessionHook could enable
> me
> > to do that?
>
> You'd use "ordinary" access control in the web server instead
> of the AttributeChecker, so <Location /account> would have the usual
> require directives, /admin would have additional restrictions, etc.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161014/a02bc315/attachment.html>