how to deny acces to a SP based on attribute value

[Guillaume Rousse]

Le 08/12/2025 à 11:12, Gianluca Amato via users a écrit :
> I think the correct approach is to use a context-check interceptor 
> (https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ 
> ContextCheckInterceptConfiguration <https://shibboleth.atlassian.net/ 
> wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration>).
You may also consider web-server access control, as documented here:
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335056/htaccess#Requiring-students-from-particular-domains

Here is a Apache solution for your problem:
<Location />
     AuthType shibboleth
     <RequireAll>
         Require shib-session
         Require shib-attr eduPersonPrimaryAffiliation ^(staff|employee)$
     </RequireAll>
  ..
</Location>

And you may also consider application-level access control, if applicable.

The best strategy is a question of personal preference, but for my own 
taste, it is usually a compromise between long-term maintainability, and 
the ability to deliver user-readable error message to minimise support 
costs.

Regards.
-- 
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4291 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20251212/9c8c4e93/attachment.p7s>