SpecificImpersonationPolicy to match target user to group

[Christopher Bongaarts]

On 6/16/2025 7:55 AM, Cantor, Scott wrote:
> The supported way to invoke the resolver is:
>
> 1. Populate and place an AttributeResolverContext somewhere in the tree with all desired fields set.
> 2. Call AttributeResolverContext's resolveAttributes() helper method with an instance of the service (the shibboleth.AttributeResolverService bean should be of the proper type I believe).
> 3. Remove the context when done with the results.

Thanks for the guidance; I see that there's similar advice on the wiki:

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511778/AttributeResolver#Programming-Guide-to-Attribute-Resolution

and I think your MFA suggestion was for the attribute-based c14n here:

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505212/AttributeSourcedPostLoginC14NConfiguration#Using-the-Attribute-Resolver

At any rate, I got something that works as I wanted; I'll share it here 
and add it as an example on the wiki on the impersonation page.  I 
created the AttributeResolutionContext under the AccessControlContext as 
it seemed a logical spot; my first attempt I put it under the 
ProfileRequestContext but that interfered with the eventual attribute 
release for the SAML itself.

----snip from conf/access-control.xml----
         <entry key="SpecificImpersonationPolicy">
             <!-- policy: most SPs allow impersonating anyone.  but 
SP_ENTITY_ID has an LDAP group listing
                  target users who are NOT allowed to be impersonated.  -->
             <bean parent="shibboleth.PredicateAccessControl">
                 <constructor-arg>
                     <bean parent="shibboleth.Conditions.NOT">
                         <constructor-arg>
                             <bean parent="shibboleth.Conditions.AND">
                                 <constructor-arg>
                                     <bean 
parent="shibboleth.Conditions.RelyingPartyId"
c:candidate="<SP_ENTITY_ID>" />
                                 </constructor-arg>
                                 <constructor-arg>
                                     <bean id="CheckIfTargetInGroup" 
parent="shibboleth.Conditions.Scripted" factory-method="inlineScript"
p:customObject-ref="shibboleth.AttributeResolverService">
                                         <constructor-arg>
                                             <value>
                                                 <![CDATA[
                                                     var acc = 
input.getSubcontext("org.opensaml.profile.context.AccessControlContext");
                                                     var targetuser = 
acc.getResource();
                                                     var arc = 
acc.ensureSubcontext("net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext");
arc.setPrincipal(targetuser);
arc.setRequestedIdPAttributeNames(["isMemberOf"]);
arc.resolveAttributes(custom);
                                                     var attrs = 
arc.getResolvedIdPAttributes();
                                                     var isMemberOf = 
attrs.get("isMemberOf");
                                                     var result = 
isMemberOf.contains("cn=do not impersonate these users,dc=example,dc=org");
acc.removeSubcontext(arc);
                                                     result;
                                                 ]]>
                                             </value>
                                         </constructor-arg>
                                     </bean>
                                 </constructor-arg>
                             </bean>
                         </constructor-arg>
                     </bean>
                 </constructor-arg>
              </bean>
         </entry>
----snip----

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%