how to deny acces to a SP based on attribute value

[Scott Cantor]

> On Dec 8, 2025, at 5:12 AM, Gianluca Amato via users <users at shibboleth.net> wrote:
> 
> I think the correct approach is to use a context-check interceptor (https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration).

That is correct.

Even were it possible to use an RP override for this, which it isn't, it's not a good approach to much of anything but handling very rare interop problems. It's for setting up your defaults, not handling special cases.

-- Scott