<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Peter Schober,<br>
<br>
Thanks for guiding on this configuration stuff. I tried the way you
have said and also by referring this link
<a class="moz-txt-link-freetext" href="https://wiki.cam.ac.uk/raven/Shibboleth_access_control_using_Apache_configuration_files">https://wiki.cam.ac.uk/raven/Shibboleth_access_control_using_Apache_configuration_files</a><br>
<br>
When I try with "Require Shibboleth" the access is allowed, but when I
try the same with "Require user <username>" I get a forbidden
error while accessing the resource. No idea why the "Require user
<username>" does not works here.<br>
How do I fix this ?? Any suggestion would be appreciated...<br>
<br>
<br>
<pre> AuthType shibboleth
ShibRequireSession On
Require user <username>
</pre>
- Badri<br>
<br>
Peter Schober wrote:
<blockquote cite="mid:20120424115002.GR32440@wssp.cc.univie.ac.at"
type="cite">
<pre wrap="">* Badri <a class="moz-txt-link-rfc2396E" href="mailto:badri@visolve.com"><badri@visolve.com></a> [2012-04-24 10:57]:
</pre>
<blockquote type="cite">
<pre wrap="">Now the question is, we already two different groups of users in ldap.
One contains all the users and another have only few important
high-privileged users.
The web root directory is protected with the following configuration.
<
AuthType Shibboleth
ShibRequireSession On
ShibApplicationId default
ShibExportAssertion On
Require Shibboleth
>
This allows all users to access. Say I want to let only the particular
group of users in ldap those are high-privileged users. How do I do it
here???
</pre>
</blockquote>
<pre wrap=""><!---->
You're not really performing any access control here, I would say.
I'll expand on that below.
First off, those two together are a bit nonsensical, AFAIU:
</pre>
<blockquote type="cite">
<pre wrap="">ShibRequireSession On
Require Shibboleth
</pre>
</blockquote>
<pre wrap=""><!---->
You only ever need "Require Shibboleth" as syntactic sugar for httpd
iff you don't want to require a session and no authorization enforced
by the webserver. (That's a rather special, albeit not uncommon case,
try searching the wiki for "lazy session".)
By contrast, "ShibRequireSession On" means you want the module to
require a session and that usually goes together with some
authorization rules (e.g. "require user foo bar baz") or the
"authentication == authenrization" directive "require valid-user".
Setting "ShibApplicationId default" is nonsensical as well, since
"default" is the default application id. And "ShibExportAssertion On"
only matters if you're actually trying to parse and XML from the
assertion and do anything with it (which I doubt).
To anwser another part of your question: The SAML IdP should send
appropriate attributes (e.g. groups the principal is a member of) and
the SAML SP can make access control decisions based on that
(e.g. "require group foo").
Attributes have specific names on-the-wire and the SP can map any
attribute name to in internal structure available to httpd's require
directive.
The final aspect of your question (nesting directives in httpd) should
be answered in the httpd docs.
-peter
--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
<pre wrap="">
<hr size="4" width="90%">
Internal Virus Database is out of date.
Checked by AVG - <a class="moz-txt-link-abbreviated" href="http://www.avg.com">www.avg.com</a>
Version: 8.5.449 / Virus Database: 271.1.1/3765 - Release Date: 07/14/11 18:38:00
</pre>
</blockquote>
<br>
</body>
</html>