AccessControl element

Young, Darren Darren.Young at chicagobooth.edu
Wed Jun 21 14:43:11 EDT 2017


I am testing out how we could use an attribute in the Shib response from
our IdP to control access to content, the attribute I¹m after is
ucisMemberOf. The machine was working with just /secure under Shib auth
but when I added the <AccessControl> element mentioned here:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap I
get an error and the SP won¹t start up.

The potion of Shibboleth2.xml with the access control is below. I have
tried both /secure/ACLPath in the Path name= as well as nested under the
parent path element (which is what¹s below) and it gets the same error.

Run a -check with shibd.exe and it generates the same error.

<RequestMapper type="Native">
  <RequestMap>
    <Host name="wwwprod.chicagobooth.edu">
				
      
      <!-- Our default /secure area, any valid ID can see -->
      <Path name="secure" authType="shibboleth" requireSession="true"/>
				
      
        <!-- /secure/AllStaff only Staff has access -->
        <Path name="AllStaff" authType="shibboleth" requireSession="true">
          <AccessControl>
            <Rule 
require=²ucisMemberOf²>uc:org:Booth:AffiliationGroups:Staff</Rule>
          </AccessControl>
        </Path>
					
      
        <!-- /secure/ITOnly only IT people have access -->
        <Path name="ITOnly" authType="shibboleth" requireSession="true">
          <AccessControl>
            <Rule 
require=²ucisMemberOf²>uc:org:Booth:AffiliationGroups:IT_Services</Rule>
          </AccessControl>
        </Path>
					
      
        <!-- /secure/Systems only the Systems group has access -->
        <Path name="Systems" authType="shibboleth" requireSession="true">
          <AccessControl>
            <Rule 
require=²ucisMemberOf²>uc:org:Booth:admgroups:Systems</Rule>
          </AccessControl>
        </Path>
    </Host>
  </RequestMap>
    </RequestMapper>



The error is: 

2017-06-21 13:31:31 ERROR XMLTooling.ParserPool : fatal error on line 59,
column 22, message: attribute value expected
2017-06-21 13:31:31 ERROR Shibboleth.Config : error while loading resource
(C:/opt/shibboleth-sp/etc/shibboleth/shibboleth2.xml): XML error(s) during
parsing, check log for specifics
2017-06-21 13:31:31 FATAL Shibboleth.Config : caught exception while
loading configuration: XML error(s) during parsing, check log for specifics
configuration is invalid, check console for specific problems

I¹ve checked all the logs, it¹s the same info.

The line number of the error is the first ³Rule² line it encounters:

<Rule require=²ucisMemberOf²>uc:org:Booth:AffiliationGroups:Staff</Rule>

I¹ve Googled for the error and haven¹t found anything related to the
AccessControl element.

Thanks in advance,

Darren Young
University of Chicago, Booth School of Business







More information about the users mailing list