How to use shibboleth.context-check.Function

[John C. Pfeifer]

Move the scripted part to the attribute-resolver.xml (I have an attribute definition called authorizedUser) since that file is reloadable. My conf/intercept/context-check-intercept-config.xml then looks like:

    <util:map id="context-check.Map">
        <entry key="authorizedUser" value="*" />
    </util:map>

    <bean id="shibboleth.context-check.Condition" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
           p:useUnfilteredAttributes="true"
           p:attributeValueMap-ref="context-check.Map" />


> On Jan 13, 2020, at 8:22 PM, Morgan, Andrew Jason <morgan at oregonstate.edu> wrote:
> 
> We have some services that won't do their own authorization, so we have multiple context checkers in Shibboleth.  Each of them checks for membership in an access group, like this:
> 
>     <bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND">
>         <constructor-arg>
>             <list>
>                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://services.box.com/sp" />
>                 <bean class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"
>                         p:useUnfilteredAttributes="true"
>                         p:attributeId="ismemberof"
>                         p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" />
>             </list>
>         </constructor-arg>
>     </bean>
> 
> It's been on my list to investigate shibboleth.context-check.Function to simplify this.
> 
> I think I can replace it with the following:
> 
> <util:map id="ConditionMap">
>     <entry key="https://services.box.com/sp">
>         <ref bean="box-access-condition"/>
>     </entry>
> </util:map>
> 
> <bean id="box-access-condition" class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"
>                         p:useUnfilteredAttributes="true"
>                         p:attributeId="ismemberof"
>                         p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" />
> 
> <bean id="shibboleth.context-check.Function" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
>         p:customObject-ref="ConditionMap">
>     <constructor-arg>
>         <value>
>         <![CDATA[
>         var event = "proceed";
>         var rpid = input.getSubcontext(
>                 "net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
>         var condition = custom.get(rpid);
>         if (condition != null && !condition.apply(input)) {
>             event = "ContextCheckDenied";
>         }
>         event;
>         ]]>
>         </value>
>     </constructor-arg>
> </bean>
> 
> Is that correct?
> 
> Is it possible to define the ConditionMap in a way that won't require me to restart Shibboleth when I make a change?
> 
> Thanks,
> Andy Morgan
> Identity & Access Management
> Oregon State University
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


//
John Pfeifer
Division of Information Technology
University of Maryland, College Park