Restricting access to a Service Provider on the IdP side ?

[Andrew Morgan]

On Tue, 14 Feb 2017, Patrick Rynhart wrote:

> Hi all,
>
> We've got a Service Provider that is currently available to all members of 
> our organisation, but we want to restrict it to only members of a particular 
> LDAP group.  We have tried working with the provider, but they don't support 
> an attribute that could be disallow access at there end.
>
> Is there anyway that we can "block" access from our end (i.e. the IdP) ?  If 
> so, how do we go about it ?
>
> With Thanks in Advance
>
> Patrick Rynhart

Patrick,

You can use the "context-check" intercept flow.  Check this out:

   https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration

Your IDP can display an error page ("Access Denied - blah blah") when the 
check fails.

As Liam said separately, you can also change your attribute filter rules 
to block the release of all attributes, but that can be cumbersome to 
write in your attribute-filter.xml file.  We are switching from blocking 
attributes to the context-check right now.  :)

One other consideration - the SP may display some gibberish error message 
if no attributes are released.  A nicely worded, institutionally-themed, 
error page presented by your IDP is probably a better experience for your 
users.

 	Andy