<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style style="display: none;" id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body tabindex="0" aria-label="Message body" fpstyle="1" dir="ltr">
<div name="divtagdefaultwrapper" id="divtagdefaultwrapper" style="font-family: Calibri,Arial,Helvetica,sans-serif; font-size: 12pt; color: #000000; margin: 0">
That's it. Thanks, Ian.<br>
<br>
Works fine after reading that NativeSPhtaccess link and understanding the "~" flag.<br>
<br>
<br>
Thanks for the help.<br>
<br>
Sean<br>
<div style="color: rgb(40, 40, 40);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> users-bounces@shibboleth.net <users-bounces@shibboleth.net> on behalf of Ian Rifkin <irifkin@brandeis.edu><br>
<b>Sent:</b> Thursday, August 29, 2013 9:29 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: sp authorization with wildcard</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hi,<br>
<br>
If you can't get the IdP to send you something more useful, I think you can specify a pattern matching rule by starting with the ~ symbol. See
<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess</a><br>
<br>
I haven't tried this (so far I have an IdP not an SP, so take what I say with a grain of salt). Maybe try something like<br>
<br>
require company-admin ~ ^Chicago.*$<br>
<br>
</div>
Regards,<br>
Ian<br>
<br>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Thu, Aug 29, 2013 at 10:08 AM, Flannery, Sean <span dir="ltr">
<<a href="mailto:sean.flannery@jwt.com" target="_blank">sean.flannery@jwt.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div name="divtagdefaultwrapper" style="font-size:12pt; margin:0px; font-family:Calibri,Arial,Helvetica,sans-serif">
Hello,<br>
<br>
I'm trying to protect an app based on a custom LDAP attribute that requires a wild card search, ie<br>
<br>
<Location /chicagoprintstudio><br>
AuthType shibboleth<br>
ShibRequireSession On<br>
require company-admin *Chicago*<br>
</Location><br>
<br>
IE, all people who administrate a Chicago company can access this URL.<br>
<br>
It works if I do an exact value like<br>
<br>
require company-admin ChicagoWestLoopPrintStudio<br>
<br>
But if I do a wild card search, it doesn't let anyone in- maybe it interprets the "*" char literally? Not sure.<br>
<br>
Anyway wondering: am I just using bad regex, or is this not supported?<br>
<br>
Any feedback is appreciated.<br>
<br>
Sean<br>
<br>
PS, I realize a group or a require statement that defines all the possible values (rather than a wild card) is the preferred solution and that will be our long term solution, but I'm wondering if I can do a short term solution while that's being worked on.</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</div>
</div>
<br clear=all>
</body>
</html>