how to deny acces to a SP based on attribute value

[Mats Luspa]

Hello!

Here we have used scripted attribute to accomplish something a like that 
you want. In ldap we have defined an own attribute called 
irfAuthorizedService. That contains values to what services a user is 
allowed to login to.
For example if the user is allowed to login to a chat service the 
irfAuthorizedService contains value chat (in our case sso login to slack).
slack demands first_name. In attribute-filter.xml it looks like this:

<AttributeFilterPolicy id="slack">
         <PolicyRequirementRule xsi:type="Requester" 
value="https://slack.com" />
         <AttributeRule attributeID="User_Email">
                 <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="User_Username">
                 <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="first_name">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="last_name">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="displayName">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>

</AttributeFilterPolicy>

In attribute-resolver.xml we release the attribute first_name for a user 
if irfAuthorizedService contains chat as said like this:

<AttributeDefinition xsi:type="ScriptedAttribute" id="first_name" 
xmlns="urn:mace:shibboleth:2.0:resolver">
         <InputDataConnector ref="myLDAP" attributeNames="givenName" />
         <InputDataConnector ref="myLDAP" 
attributeNames="irfAuthorizedService" />
         <AttributeEncoder xsi:type="SAML2String" 
xmlns="urn:mace:shibboleth:2.0:resolver" name="first_name" 
friendlyName="first_name" />
         <Script>
           <![CDATA[
                if ((irfAuthorizedService) && 
(irfAuthorizedService.getValues().contains("chat"))) {
first_name.getValues().add(givenName.getValues().get(0));
                }
           ]]>
         </Script>
</AttributeDefinition>

However it's not so fancy that an own-defined error message comes up (if 
the irfAuthorizedService doesn't contain chat) but we think it's a 
rather simple solution.

/Regards Mats

On 12/7/25 7:09 PM, jehan.procaccia at tem-tsp.eu wrote:
>
> Hello
>
> I want to  deny access to a specific SP to users whose ldap resolved 
> attribute  contains specific values and allow for other values
>
> in my case specific SP is entityID /https://sp.im.fr/sp/ and attribute 
> is /eduPersonPrimaryAffiliation/ which should be = to "staff" or 
> "employee" to be allowed access, if a value of "student" is resolved 
> (or others as affiliate,member ...) , access to the SP should be denied .
>
> So I have created a RelyingPartyOverrides in relaying-party.xml with 
> activationCondition based on the value of the attribute for that 
> specific relyingParty, the code is loaded (IDP starts well, it took me 
> a while with lots of errors ...) , now users can connect , but also 
> users with eduPersonPrimaryAffiliation that are different from staff 
> or employee  in my case [1] :-(
>
> I guess that my IdP (v5.1.6) does not deny access when my 
> relying-party activationCondition evaluates to false, and then it 
> might falls back to the default relying-party config with the default 
> SAML2 SSO profile which is not restricted !?
>
> can you help me buiding an operational configuration that allow access 
> to that specific SP only for users whose /eduPersonPrimaryAffiliation 
> = staff or employee /?
>
> is relying-party.xml the right place to do that, or access-control.xml 
> file should be involved ?
>
> regard
>
> jehan
>
> / <util:list id="*shibboleth.RelyingPartyOverrides*">
> /
>
> /                <bean id="MistralAI" parent="RelyingPartyByName" 
> *c:relyingPartyIds="#{{'https://sp.im.fr/sp'}}"*>
>
>     <property name="*activationCondition*">
>         <bean parent="*shibboleth.Conditions.SimpleAttribute*">
>             <property name="attributeValueMap">
>                 <map>
>                     <entry key="*eduPersonPrimaryAffiliation*">
>                         <list>
>                             <value>*staff*</value> /
>
> /<value>employee</value>/
>
> /                        </list>
>                     </entry>
>                 </map>
>             </property>
>         </bean>
> </property>
>
>       <property name="profileConfigurations">
>         <list>
>             <bean parent="SAML2.SSO"
>                   p:encryptAssertions="false"
>                   p:checkAddress="false" />
>         </list>
>     </property>
>
> </bean>/
>
>
-- 
-- 
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email:matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
-- 
PGP Public Key:https://www.irf.se/pgp/matsl
Digital vcard:https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251208/97d0d07e/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4382 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20251208/97d0d07e/attachment.p7s>