issue with context-check intercept flow

[Mark Y. Goh]

Hello,
I am having issues getting ContextCheckInterceptConfiguration working on 5
using (tier/shib-idp:5.0.0_20230914).

>From the docs it seems like this context-check-intercept-config.xml [2]
should work but it does not seem to be evaluating the relying party
correctly and hence the flow continues when it should not. Interestingly, I
was able to get it working when I moved the script in the
attribute-filter.xml like in this older thread [1] but I would like to use
the Function and show the user a IDP ContextCheckDenied error instead of
from the SP.

thanks for any help!

mark
[1] https://shibboleth.net/pipermail/users/2020-January/045854.html
[2] sanitized context-check-intercept-config.xml:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <util:map id="ConditionMap">
        <entry key='https://some-test-server.edu'>
            <ref bean="moo-access-condition"/>
        </entry>
    </util:map>

    <bean id="moo-access-condition"
class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"
                            p:useUnfilteredAttributes="true"
                            p:attributeId="eduPersonAssurance"
                            p:pattern="(?i)some_value" />

    <bean id="shibboleth.context-check.Function"
parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
            p:customObject-ref="ConditionMap">
        <constructor-arg>
            <value>
            <![CDATA[
            var rpid =
input.ensureSubcontext("net.shibboleth.profile.context.RelyingPartyContext").getRelyingPartyId();
            var condition = custom.get(rpid);
            if (condition != null && !condition.test(input)) {
                event = "ContextCheckDenied";
            }
            event;

            ]]>
            </value>
        </constructor-arg>
    </bean>
</beans>


-- 

Mark Y. Goh (he/him), Site Reliability Engineer, California College of
the Arts, mgoh at cca.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240926/f5a8a75a/attachment.htm>