Path access control, a bit better

[Cantor, Scott]

On 7/12/17, 4:20 PM, "users on behalf of Young, Darren" <users-bounces at shibboleth.net on behalf of Darren.Young at chicagobooth.edu> wrote:

> I just thought of something, is that plugin case sensitive?

Yes.

> I copied the values of the groups from the Grouper UI and they show the path as it was
> entered. But, if I remember correctly, when those hit the Shib SP they¹re all lower case. At least I think they are.

The handler will tell you with no ambiguity but that much you can see in the SAML message too.

As far as use of Grouper, I'll give you my opinion, which is that Grouper should be using case-sensitive URIs unequivocally for group naming, and that having not done so, I don't think people should expose those directly to Shibboleth SPs, but should morph them into URIs via eduPersonEntitlement, which is, again, case-sensitive.

OSU is going to have to deal with that question shortly, and that's my personal feeling regarding doing it.

-- Scott