SP Authorization via ContextCheckPredicate

[Jann Malenkoff]

Following on earlier threads on the mailing list from Feb 13, 2017 -- is
the below suitable on how we can restrict users to an SP based on presence
of 2 isMemberOf groups and an eduPersonEntitlement?


<bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND">
        <constructor-arg>
            <list>
               <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidates="#{ 'https://sp.example.org' }" />
                <bean
class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
                        p:useUnfilteredAttributes="true">
                    <property name="attributeValueMap">
                        <map>
                            <entry key="isMemberOf">
                                <list>
                                    <value
type="java.lang.String">some_allowed_group_name</value>
                                    <value
type="java.lang.String">another_allowed_group_name</value>
                                </list>
                                 <entry key="eduPersonEntitlement">
                                <list>
                                    <value type="java.lang.String">
https://example.edu/student</value>
                                </list>
                            </entry>
                        </map>
                    </property>
                </bean>
            </list>
        </constructor-arg>
    </bean>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170626/680cb9b6/attachment-0001.html>