SpecificImpersonationPolicy to match target user to group

[Christopher Bongaarts]

Goal: for one particular (or maybe a set of particular) SPs, I want to 
allow impersonation of all target users EXCEPT those who are members of 
a particular LDAP group (same LDAP as our usual DataConnector for 
attribute resolution).

The SpecificImpersonationPolicy should be the right place to do this, 
and a little boolean algebra shows that

NOT ( (relyingparty == SP) AND (targetuser IN group) )

should get me what I want.  shibboleth.Conditions.NOT, .AND, and 
.RelyingPartyId get me the first half.  I'm having a little more trouble 
figuring out where the requested target user identifier ends up, and how 
to do an additional LDAP search to check the group membership once I 
have it.

The example policy on the wiki suggests this might give me the target 
user ID:

<bean parent="shibboleth.ContextFunctions.Expression"
c:expression="#input.getSubcontext(T(org.opensaml.profile.context.AccessControlContext)).getResource()" 
/>

so I'm just left with the LDAP search problem.  I'm going source 
spelunking on promising looking ResolveAttributes beans, but please let 
me know if there's an easier way to get this.

I know the DN of the group containing the Users Not To Be Impersonated, 
and the group object contains DNs, so I might need an extra search to 
get the DN corresponding to the requested target username.

Thanks!

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%