Filtering query based on attribute values

[Brent Putman]

On 4/17/17 1:37 PM, Cantor, Scott wrote:
>
>  
>> I have tried a directive “LocationMatch” and a “require” and shib-attr with the matched string but it does not seem to work.

To be clear, are you trying to use a something like a named match group
expression in the require rule, similar to this?:


<LocationMatch "^/(?<orgunit>[^/]+)/foo/bar">
    require shib-attr orgunit %{env:MATCH_ORGUNIT}
</LocationMatch>


FYI, according to the Apache docs [1], that only works in 2.4.8+. 


> Well, that does work, so your problem is with Apache configuration or the data you're actually getting.
>

I may be reading too much into the OP's question, but do we know for a
fact that a "dynamic runtime" require rule like the above works?  For
example, does mod_shib need to invoke any special httpd machinery in
order for the expression eval to happen properly?



[1] http://httpd.apache.org/docs/2.4/mod/core.html#locationmatch
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170417/50f89406/attachment.html>