Path access control, a bit better

[Young, Darren]

It’s a bit better now…

I moved the / from the first path statement to a separate </Path> down
below the child elements and restarted with no errors. I am granted access
to /secure however anything below that I receive a 403 in my browser and
the following entry is in native.log:

2017-07-12 14:10:29 WARN Shibboleth.ServiceProvider [3736] isapi_shib:
access control provider denied access

I verified my account is in the following groups:

uc:org:Booth:AffiliationGroups:Staff

uc:org:Booth:AffiliationGroups:IT_Services


ucIsMemberof sources from Grouper which I would imaging you either knew or
guessed but I checked both Grouper as well as the Shib response as well,
they’re there.


So in theory I should only be denied access to the “student only” url.

That section of the config now:

<RequestMapper type="Native">
  <RequestMap>
    <Host name="wwwprod.chicagobooth.edu²>

                
      <!-- Our default /secure area, any valid ID can see -->
      <Path name="secure" authType="shibboleth" requireSession="true">

        <Path name="AllStaff" authType=“shibboleth" requireSession="true">
          <AccessControl>
            <Rule 
require="ucisMemberOf">uc:org:Booth:AffiliationGroups:Staff</Rule>
          </AccessControl>
        </Path>

        <Path name="ITOnly" authType=“shibboleth" requireSession="true">
          <AccessControl>
            <Rule 
require="ucisMemberOf">uc:org:Booth:AffiliationGroups:IT_Services</Rule>
          </AccessControl>
        </Path>

        <Path name="FullTimeOnly" authType=“shibboleth"
requireSession="true">
          <AccessControl>
            <Rule 
require="ucisMemberOf">uc:org:Booth:AffiliationGroups:MBA_Campus</Rule>
          </AccessControl>
        </Path>

      </Path>
    </Host>
  </RequestMap>
    </RequestMapper>

ThoughtS?