how to deny acces to a SP based on attribute value

[jehan.procaccia at tem-tsp.eu]

Hello

I want to  deny access to a specific SP to users whose ldap resolved 
attribute  contains specific values and allow for other values

in my case specific SP is entityID /https://sp.im.fr/sp/ and attribute 
is /eduPersonPrimaryAffiliation/ which should be = to "staff" or 
"employee" to be allowed access, if a value of "student" is resolved (or 
others as affiliate,member ...) , access to the SP should be denied .

So I have created a RelyingPartyOverrides in relaying-party.xml with 
activationCondition based on the value of the attribute for that 
specific relyingParty, the code is loaded (IDP starts well, it took me a 
while with lots of errors ...) , now users can connect , but also users 
with eduPersonPrimaryAffiliation that are different from staff or 
employee  in my case [1] :-(

I guess that my IdP (v5.1.6) does not deny access when my relying-party 
activationCondition evaluates to false, and then it might falls back to 
the default relying-party config with the default SAML2 SSO profile 
which is not restricted !?

can you help me buiding an operational configuration that allow access 
to that specific SP only for users whose /eduPersonPrimaryAffiliation = 
staff or employee /?

is relying-party.xml the right place to do that, or access-control.xml 
file should be involved ?

regard

jehan

/ <util:list id="*shibboleth.RelyingPartyOverrides*">
/

/                <bean id="MistralAI" parent="RelyingPartyByName" 
*c:relyingPartyIds="#{{'https://sp.im.fr/sp'}}"*>

     <property name="*activationCondition*">
         <bean parent="*shibboleth.Conditions.SimpleAttribute*">
             <property name="attributeValueMap">
                 <map>
                     <entry key="*eduPersonPrimaryAffiliation*">
                         <list>
                             <value>*staff*</value> /

/<value>employee</value>/

/                        </list>
                     </entry>
                 </map>
             </property>
         </bean>
</property>

       <property name="profileConfigurations">
         <list>
             <bean parent="SAML2.SSO"
                   p:encryptAssertions="false"
                   p:checkAddress="false" />
         </list>
     </property>

</bean>/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251207/c5973d5a/attachment.htm>