SPNEGO Activation condition breaks session manager properties

[Robert Duncan]

Thanks Daniel!

That has worked, instructions on the wiki are much clearer now

Robert Duncan.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Lutz
Sent: Friday 26 January 2018 14:44
To: users at shibboleth.net
Subject: Re: SPNEGO Activation condition breaks session manager properties

Robert Duncan [26.01.18 13:07]:
> I have SPNEGO login flow active and working well, however I do need to restrict its' availability and am trying the activation condition based on the examples:
> https://wiki.shibboleth.net/confluence/display/IDP30/SPNEGOAuthnConfiguration#SPNEGOAuthnConfiguration-ExampleConditionsinJavaScript:

> This should disable SPNEGO on my VLAN for testing, but the idp complains:

I think the problem is that you need to place your activation condition bean outside the <util:list id="shibboleth.AvailableAuthenticationFlows">, e.g. just before it:

    ...

    <bean id="shibboleth.SPNEGO.ActivationCondition" parent="shibboleth.Conditions.Scripted" factory-method="inlineScript"
             p:customObject-ref="shibboleth.HttpServletRequest">
         <constructor-arg>
            <value>
              <![CDATA[
                    var activate = false;
                    if (custom.remoteAddr.startsWith("192.168.42.")) {
                    activate = true;
                    }
                    activate;
                 ]]>
            </value>
        </constructor-arg>
   </bean>

    <util:list id="shibboleth.AvailableAuthenticationFlows">

    ...

I've just updated the documentation to make this clearer.


- Daniel
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
________________________________

The information contained and transmitted in this e-mail is confidential information, and is intended only for the named recipient to which it is addressed. The content of this e-mail may not have been sent with the authority of National College of Ireland. Any views or opinions presented are solely those of the author and do not necessarily represent those of National College of Ireland. If the reader of this message is not the named recipient or a person responsible for delivering it to the named recipient, you are notified that the review, dissemination, distribution, transmission, printing or copying, forwarding, or any other use of this message or any part of it, including any attachments, is strictly prohibited. If you have received this communication in error, please delete the e-mail and destroy all record of this communication. Thank you for your assistance.
________________________________