Filtering query based on attribute values

[Brent Putman]

On 4/17/17 4:53 PM, Yannick Béot wrote:
> Hi,
>
> That is the same kind of configuration I have tried and that I had in
> mind.
>
> By using static value, it worked. For instance:
> require shib-attr orgunit XXX
>
> I have to check the apache version though.

If the httpd is new enough for the match group to work, but if it turns
out that mod_shib doesn't do the expression parsing necessary, then it
might be possible to get the same effective config using the more
general 2.4 'Require expr' support [1], which can take any valid
expression [2].  This is off-the-cuff and untested, but something like
this might work:


<LocationMatch "^/(?<orgunit>[^/]+)/foo/bar">
    require expr "%{env:orgunit} == %{env:MATCH_ORGUNIT}"
</LocationMatch>


That's assuming the use of attributes as environment vars rather than
request headers, and that the attribute is "orgunit".   (Or maybe the
env var would be something like HTTP_ORGUNIT, I can't keep it all straight).



[1] http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#reqexpr

[2] http://httpd.apache.org/docs/2.4/expr.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170417/7b783ae4/attachment.html>