How to use shibboleth.context-check.Function

[Morgan, Andrew Jason]

We have some services that won't do their own authorization, so we have multiple context checkers in Shibboleth.  Each of them checks for membership in an access group, like this:

    <bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND">
        <constructor-arg>
            <list>
                <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://services.box.com/sp" />
                <bean class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"
                        p:useUnfilteredAttributes="true"
                        p:attributeId="ismemberof"
                        p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" />
            </list>
        </constructor-arg>
    </bean>

It's been on my list to investigate shibboleth.context-check.Function to simplify this.

I think I can replace it with the following:

<util:map id="ConditionMap">
    <entry key="https://services.box.com/sp">
        <ref bean="box-access-condition"/>
    </entry>
</util:map>

<bean id="box-access-condition" class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"
                        p:useUnfilteredAttributes="true"
                        p:attributeId="ismemberof"
                        p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" />

<bean id="shibboleth.context-check.Function" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
        p:customObject-ref="ConditionMap">
    <constructor-arg>
        <value>
        <![CDATA[
        var event = "proceed";
        var rpid = input.getSubcontext(
                "net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
        var condition = custom.get(rpid);
        if (condition != null && !condition.apply(input)) {
            event = "ContextCheckDenied";
        }
        event;
        ]]>
        </value>
    </constructor-arg>
</bean>

Is that correct?

Is it possible to define the ConditionMap in a way that won't require me to restart Shibboleth when I make a change?

Thanks,
Andy Morgan
Identity & Access Management
Oregon State University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200114/8549b6e5/attachment.html>