<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Consolas" size="2"><span style="font-size:10.5pt;">
<div>Hi,</div>
<div> </div>
<div>I feel sure that this is (or should be) a FAQ, but I don't see it being asked or answered anywhere (maybe I’ve looked in the wrong places).</div>
<div> </div>
<div>I'd like to limit access to a SP to users that are members of a specific group.</div>
<div> </div>
<div>At the moment I have a filter policy like this:</div>
<div> <afp:AttributeFilterPolicy id="groupauthz-filter"></div>
<div> </div>
<div> <afp:PolicyRequirementRule xsi:type="basic:AND"></div>
<div> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://testsp.example.com/shibboleth">https://testsp.example.com/shibboleth</a>" /></div>
<div> <basic:Rule xsi:type="basic:AttributeValueString" attributeID="isMemberOf" value="cn=myGroup, ou=Groups,dc=example,dc=com"/></div>
<div> </afp:PolicyRequirementRule></div>
<div> </div>
<div> <afp:AttributeRule attributeID="transient-id"></div>
<div> <afp:PermitValueRule xsi:type="basic:ANY"/></div>
<div> </afp:AttributeRule></div>
<div> </div>
<div> </afp:AttributeFilterPolicy></div>
<div> </div>
<div>This works for some cases: if the user is a direct member of the group, they have an isMemberOf attribute that matches the value, the policy matches and they get access to the SP.</div>
<div>However, we have nested group memberships, e.g. "userA" is a member of "groupB", which is a member of "myGroup", so userA doesn't actually have an isMemberOf attribute that matches myGroup.</div>
<div> </div>
<div>So... is there a straightforward way of doing nested group authorization in Shibboleth? Our group memberships are in an openLDAP directory at the moment. One approach that I can see would be to maintain a "flattened" representation of group membership
(perhaps in a database rather than bloating the directory), but it would be nice if there was a more elegant solution.</div>
<div> </div>
<div>Steve.</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
</span></font>
</body>
</html>