IDP3 - Trying to only allow certain users

[gwaters]

Hi All,
I am trying to create a filter, that only allows certain users to use an SP.

I have created an nsrole in ldap, and only want users with this role to be
able to use this SP. I read the wiki pages, which are great btw, but... 
I am using IDP3, and I am guessing I dont quite understand how
"basic:AttributeValueString" works in filters.

AttributeValueString - Evaluates to true if the value of a given attribute
matches a given string


Here is an excerpt of my filter:
    <AttributeFilterPolicy id="ReleasetoSlack">

        <PolicyRequirementRule xsi:type="AND">
            <Rule xsi:type="Requester" value="https://slack.com/" />
            <Rule xsi:type="basic:AttributeValueString" attributeID="slack"
value="true" ignoreCase="true" />
        </PolicyRequirementRule>

        <AttributeRule attributeID="User.Email">
                <PermitValueRule xsi:type="ANY" />
        </AttributeRule>

    </AttributeFilterPolicy>

</AttributeFilterPolicyGroup>

And here is the attribute resolver to get the role and return, "true":
    <resolver:AttributeDefinition xsi:type="ad:Mapped"
id="caltech_imss_slack" sourceAttributeID="nsrole" >
        <resolver:Dependency ref="myLDAP" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="slack"
friendlyName="slack" />

        <ad:ValueMap>
            <ad:ReturnValue>"true"</ad:ReturnValue>
           
<ad:SourceValue>cn=slack,ou=SOMEOU,ou=ANOTHEROU,o=SOMEORG,c=us</ad:SourceValue>
        </ad:ValueMap>

    </resolver:AttributeDefinition>

I think the resolver works because of this in the logs:
2016-09-20 16:25:27,392 - [] - [] - INFO
[net.shibboleth.idp.attribute.resolver.spring.ResolverPluginDependencyParser:54]
- Parsing configuration for Dependency with pluginId: myLDAP
2016-09-20 16:25:27,392 - [] - [] - DEBUG
[net.shibboleth.idp.attribute.resolver.spring.ad.BaseAttributeDefinitionParser:93]
- Attribute Definition 'slack': Setting sourceAttributeID nsrole
2016-09-20 16:25:27,392 - [] - [] - DEBUG
[net.shibboleth.idp.attribute.resolver.spring.ad.BaseAttributeDefinitionParser:108]
- Attribute Definition 'slack': Adding 1 encoders
2016-09-20 16:25:27,393 - [] - [] - DEBUG
[net.shibboleth.idp.attribute.resolver.spring.ad.mapped.impl.SourceValueParser:75]
- SourceValue value: cn=slack,ou=SOMEOU,ou=ANOTHEROU,o=SOMEORG,c=us,
ignoreCase: null, partialMatch: null
2016-09-20 16:25:27,393 - [] - [] - DEBUG
[net.shibboleth.idp.attribute.resolver.spring.ad.mapped.impl.ValueMapParser:85]
- AttributeDefinition(ValueMap): return value: "true", 1 source values 
2016-09-20 16:25:27,394 - [] - [] - DEBUG
[net.shibboleth.idp.attribute.resolver.spring.ad.mapped.impl.MappedAttributeDefinitionParser:90]
- Attribute Definition 'slack': passThru = null, defaultValue = null, 1
value maps
2016-09-20 16:27:00,295 - [MY_IP_ADDR] - [876F1609D821BBA66BEF6F123115A355]
- DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247] -
Attribute Definition 'slack': produced an attribute with the following
values [StringAttributeValue{value="true"}]
2016-09-20 16:27:00,296 - [MY_IP_ADDR] - [876F1609D821BBA66BEF6F123115A355]
- DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:272] -
Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition
'slack' produced an attribute with 1 values

So It looks like id='slack' = "true".. but when I go to the filters in the
logs, it looks like its not working:

2016-09-20 16:40:01,173 - [MY_IP_ADDR] - [E3FEAD76A8F338C7AE64E6F21E50FFBF]
- DEBUG [net.shibboleth.idp.attribute.filter.PolicyFromMatcher:80] -
Bridging for class
'/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/Rule:slack'  Matcher
returned no values for any attribute.  Return FALSE

Should I use a SCRIPT instead ? 

Thanks,
Gary



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/IDP3-Trying-to-only-allow-certain-users-tp7628413.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.