how to deny acces to a SP based on attribute value

[Gianluca Amato]

I think the correct approach is to use a context-check interceptor (
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration
).

You need to first install the support with:

bin/module.sh -e idp.intercept.ContextCheck

Then, you need to modify conf/relying-party.xml enabling the
post-authentication flow.

<bean parent="SAML2.SSO"
p:postAuthenticationFlows="#{{'context-check'}}"
p:encryptAssertions="false" />

Finally, create a file
*conf/intercept/context-check-intercept-config.xml  *with
the configuration. We use something liek the following:

<!-- Bean for restricting access to the admin user. --><bean
id="OnlyAdmin" parent="shibboleth.Conditions.SimpleAttribute"
p:useUnfilteredAttributes="true">
  <property name="attributeValueMap">
    <map>
      <entry key="uid">
        <list>
          <value>admin_uid</value>
        </list>
      </entry>
    </map>
  </property></bean>
<!-- Bean for restricting access to people with member affiliation. -->
<bean id="OnlyMembers" parent="shibboleth.Conditions.SimpleAttribute"
p:useUnfilteredAttributes="true">
  <property name="attributeValueMap">
   <map>
     <entry key="eduPersonAffiliation">
        <list>
          <value>member</value>
        </list>
     </entry>
   </map>
   </property>
</bean>
<!-- Map associating each SP entity id to its access condition.
--><util:map id="ConditionMap">
       <entry key="sp_entity_id_1">
        <ref bean="OnlyAdmin"/>
      </entry>
      <entry key="sp_entity_id_2">
        <ref bean="OnlyMembers"/>
      </entry></util:map>

 <!-- Bean checking the access condition for each SP entity id
--><bean id="shibboleth.context-check.Function"
parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"      c:outputType="java.lang.String"
p:customObject-ref="ConditionMap">
  <constructor-arg>
    <value>
      <![CDATA[      var event = "proceed";      var rpid =
input.getSubcontext(
"net.shibboleth.profile.context.RelyingPartyContext").getRelyingPartyId();
     var condition = custom.get(rpid);      if (condition != null &&
!condition.test(input)) {          event = "ContextCheckDenied";
}      event;      ]]>
   </value>
 </constructor-arg></bean>


Best regards,
--gianluca

On Sun, Dec 7, 2025 at 7:15 PM jehan.procaccia at tem-tsp.eu <
jehan.procaccia at tem-tsp.eu> wrote:

> Hello
>
> I want to  deny access to a specific SP to users whose ldap resolved
> attribute  contains specific values and allow for other values
>
> in my case specific SP is entityID *https://sp.im.fr/sp
> <https://sp.im.fr/sp>* and attribute is *eduPersonPrimaryAffiliation*
> which should be = to "staff" or "employee" to be allowed access, if a value
> of "student" is resolved (or others as affiliate,member ...) , access to
> the SP should be denied .
>
> So I have created a RelyingPartyOverrides in relaying-party.xml with
> activationCondition based on the value of the attribute for that specific
> relyingParty, the code is loaded (IDP starts well, it took me a while with
> lots of errors ...) , now users can connect , but also users with
> eduPersonPrimaryAffiliation that are different from staff or employee  in
> my case [1] :-(
>
> I guess that my IdP (v5.1.6) does not deny access when my relying-party
> activationCondition evaluates to false, and then it might falls back to the
> default relying-party config with the default SAML2 SSO profile which is
> not restricted !?
>
> can you help me buiding an operational configuration that allow access to
> that specific SP only for users whose  *eduPersonPrimaryAffiliation =
> staff or employee *?
>
> is relying-party.xml the right place to do that, or access-control.xml
> file should be involved ?
>
> regard
>
> jehan
>
>
> * <util:list id="shibboleth.RelyingPartyOverrides"> *
>
>
>
>
>
>
>
>
>
> *                <bean id="MistralAI" parent="RelyingPartyByName"
> c:relyingPartyIds="#{{'https://sp.im.fr/sp <https://sp.im.fr/sp>'}}">
>                       <property name="activationCondition">         <bean
> parent="shibboleth.Conditions.SimpleAttribute">             <property
> name="attributeValueMap">                 <map>                     <entry
> key="eduPersonPrimaryAffiliation">                         <list>
>                             <value>staff</value> *
>
> *                            <value>employee</value>*
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *                        </list>                     </entry>
>                 </map>             </property>         </bean> </property>
>       <property name="profileConfigurations">         <list>
> <bean parent="SAML2.SSO"                   p:encryptAssertions="false"
>                   p:checkAddress="false" />         </list>     </property>
> </bean>*
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251208/a185aaf0/attachment.htm>