Attribute checking based on sp location

[Cantor, Scott]

> This scenario is tricking me: a user logs in as a non-admin account to /account,
> then if he moves to /admin a 403 Forbidden error is generated (as expected).
> In the latter case I need to remove the sp session and trigger a new
> authentication for /account which will allow the user to access the resource...
> but how to do that without using flushSession?

You do it in your application and avoid static rules.

> I know I can set a custom 403 page through Apache ErrorDocument, but can I
> remove sp session from there, then redirect back to the forbidden location
> to trigger a new authn request?

With script, and using the logout mechanism, probably.

-- Scott