Path access control, a bit better

[Cantor, Scott]

On 7/12/17, 4:05 PM, "users on behalf of Young, Darren" <users-bounces at shibboleth.net on behalf of Darren.Young at chicagobooth.edu> wrote:

> Here¹s what I¹m getting from /Shibboleth.sso/Session for me, 76 values for
> the ucisMemberOf sounds about right.

I could imagine that breaking a header size limitation but that doesn't impact the plugin that's denying access. In any case, if showing the values includes the right ones, I don't have any suggestions, it's pretty clearly logging that it doesn't see them.

I would be reverting to rules against a simpler attribute with fewer values and seeing if that changes anything. Only way to fix a problem that doesn't make sense is a lot of sanity checking.

-- Scott