Restricting access to a Service Provider on the IdP side ?

[O'Dowd, Josh]

> We've got a Service Provider that is currently available to all members 
of our organisation, but we want to restrict it to only members of a 
particular LDAP group.  We have tried working with the provider, but 
they don't support an attribute that could be disallow access at there end.

We had the same issue with one of our vendors

> Is there any way that we can "block" access from our end (i.e. the IdP) ? 
  If so, how do we go about it ?

Yes, you can set up an intercept flow that implements a context check predicate based on a preloaded shibboleth condition, like 'shibboleth.Conditions.AND', and use it to evaluate the attributeValueMap for resolved attributes.
Your "decision bean", used in the intercept-flow would look something like:

   <bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND">
        <constructor-arg>
            <list>
                <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
                        p:useUnfilteredAttributes="true">
                    <property name="attributeValueMap">
                        <map>
                            <entry key="isMemberOf">
                                <list>
                                    <value type="java.lang.String">some_allowed_group_name</value>
                                    <value type="java.lang.String">another_allowed_group_name</value>
                                </list>
                            </entry>
                        </map>
                    </property>
                </bean>
            </list>
        </constructor-arg>
    </bean>

Then you have to wire the intercept flow to a RelyingPartyOverride for the SP(s) you are restricting.

Lastly the intercept flow can end-state on a custom event ID so that you can handle it at the IdP, or allow an error response to the SP.

Josh O'Dowd