<div dir="ltr"><div>Hi,<br><br>If you can't get the IdP to send you something more useful, I think you can specify a pattern matching rule by starting with the ~ symbol. See <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPhtaccess</a><br>
<br>I haven't tried this (so far I have an IdP not an SP, so take what I say with a grain of salt). Maybe try something like<br><br>require company-admin ~ ^Chicago.*$<br><br></div>Regards,<br>Ian<br><br><div class="gmail_extra">
<br><br><div class="gmail_quote">On Thu, Aug 29, 2013 at 10:08 AM, Flannery, Sean <span dir="ltr"><<a href="mailto:sean.flannery@jwt.com" target="_blank">sean.flannery@jwt.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div name="divtagdefaultwrapper" style="font-size:12pt;margin:0px;font-family:Calibri,Arial,Helvetica,sans-serif">
Hello,<br>
<br>
I'm trying to protect an app based on a custom LDAP attribute that requires a wild card search, ie<br>
<br>
<Location /chicagoprintstudio><br>
AuthType shibboleth<br>
ShibRequireSession On<br>
require company-admin *Chicago*<br>
</Location><br>
<br>
IE, all people who administrate a Chicago company can access this URL.<br>
<br>
It works if I do an exact value like<br>
<br>
require company-admin ChicagoWestLoopPrintStudio<br>
<br>
But if I do a wild card search, it doesn't let anyone in- maybe it interprets the "*" char literally? Not sure.<br>
<br>
Anyway wondering: am I just using bad regex, or is this not supported?<br>
<br>
Any feedback is appreciated.<br>
<br>
Sean<br>
<br>
PS, I realize a group or a require statement that defines all the possible values (rather than a wild card) is the preferred solution and that will be our long term solution, but I'm wondering if I can do a short term solution while that's being worked on.</div>
</div></blockquote></div></div></div>