Deny access to RP based on Kerberos Realm

[Katy Czar]

Hi Scott,
Thanks for this information, the context check interceptor sounds perfect for what we need.

__________________________________________________________________________________________
Katy Czar
Systems Architecture & Admin
University of Vermont
kczar at uvm.edu<mailto:kczar at uvm.edu>

________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Tuesday, December 10, 2024 12:52 PM
To: Shib Users <users at shibboleth.net>
Cc: Katy Czar <katrina.czar at uvm.edu>; Jim Lawson (he/him) <jtl at uvm.edu>
Subject: Re: Deny access to RP based on Kerberos Realm

> Should this be done with an activation condition, or
> configured in the MFA login flow? I have implemented the
> chaining of multiple Kerberos validators as described in this
> guide

Really depends what user experience you want from it. You could slap activation condition in lots of different spots but that's fundamentally a way to largely silently "not do somethiing" based on those criteria, so the user probably gets an authentication failure.

An authorization decision sort of thing is handled by the context check interceptor, which is outside/after all of that stuff and is a more deliberate/direct way to allow creation of events/messages in response to the relevant inputs.

Vermont is a member, so I will send you something offline to see about getting people access to the support systems, that's a better place to get into more specifics or talk about examples.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241210/9baf0f48/attachment.htm>