Filtering query based on attribute values

[Yannick Béot]

Hi,

That is the same kind of configuration I have tried and that I had in mind.

By using static value, it worked. For instance:
require shib-attr orgunit XXX

I have to check the apache version though.

Regards,

Yannick

On Mon, Apr 17, 2017 at 8:12 PM, Brent Putman <putmanb at georgetown.edu>
wrote:

>
>
> On 4/17/17 1:37 PM, Cantor, Scott wrote:
>
>
>   I have tried a directive “LocationMatch” and a “require” and shib-attr with the matched string but it does not seem to work.
>
>
> To be clear, are you trying to use a something like a named match group
> expression in the require rule, similar to this?:
>
>
> <LocationMatch "^/(?<orgunit>[^/]+)/foo/bar">
>     require shib-attr orgunit %{env:MATCH_ORGUNIT}
> </LocationMatch>
>
>
> FYI, according to the Apache docs [1], that only works in 2.4.8+.
>
>
> Well, that does work, so your problem is with Apache configuration or the data you're actually getting.
>
>
>
> I may be reading too much into the OP's question, but do we know for a
> fact that a "dynamic runtime" require rule like the above works?  For
> example, does mod_shib need to invoke any special httpd machinery in order
> for the expression eval to happen properly?
>
>
>
> [1] http://httpd.apache.org/docs/2.4/mod/core.html#locationmatch
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170417/16a12787/attachment.html>