Attribute release based on IP address

[Niva Agmon]

Thanks Scott!

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, October 20, 2016 8:15 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Attribute release based on IP address

> It is:
> * We have an application for use by dorm residents. Currently, 
> authorization is done through the eduPersonEntitlement attribute, 
> based on a script in attribute resolver.
> * We were asked to let anyone who is logging in from the pc labs on 
> campus to also use this application.

Ok, that's indeed just a script to inject the entitlement based on the IP address. As I said, we have an IPRange class in java-support that can do that pretty easily.

What you want to do is create a map bean that has a couple of slots in it, one for the HttpServletRequest I mentioned and another with an IPRange (or collection of them), which you can create with simple CIDR masks (look at the access control examples).

Then you can inject the map as the script's custom object, and access the map entries by their keys to get at the IPRange rule(s) and the servlet request to get the client address and do the IPRange calculation.

My original responses were obviously assuming a totally different use case.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net