<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div>+1. Not sure I understand either...</div>
<div><br>
</div>
<div><font style="color:#333333"><i>Sent from my Verizon Wireless 4G LTE DROID</i></font></div>
</div>
<div class="elided-text">On Dec 1, 2015 5:14 PM, "Bellina, Brendan" <bbellina@ucla.edu> wrote:<br type="attribution">
<blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><font size="2"><span style="font-size:10pt"></span></font>
<div>Glad you were able to get the behavior you wanted, but I¹m left a bit<br>
confused. This is checking against the user¹s display name attribute<br>
value, not the display name of a group the user is in, right? I thought<br>
you were trying to determine what groups the user was in.<br>
<br>
Regards,<br>
<br>
Brendan Bellina<br>
Identity Mgmt. Architect, IT Services, UCLA<br>
<br>
<br>
<br>
On 12/1/15, 1:29 PM, "users on behalf of Cahill, Charles (GE Appliances)"<br>
<users-bounces@shibboleth.net on behalf of Charles.Cahill@ge.com> wrote:<br>
<br>
>Thank you all for your input on this. I was able to solve the problem by<br>
>using configurations<br>
>on the Apache side SP.<br>
><br>
>Made the below changes in the shib.conf<br>
>Require shib-attr displayname ${DISPLAYNAME} did the trick. Now, only<br>
>users with a specific LDAP<br>
>Displayname can access my application. I am feeding in the<br>
>APPLICATION_ENDPOINT,<br>
>PROTECTEDAPPROOT AND DISPLAYNAME as variables in docker that are fed into<br>
>the Apache SP code<br>
>I have in github to create an Apache instance with the Shibboleth Service<br>
>Provider installed.<br>
><br>
><VirtualHost *:80><br>
> <br>
> ProxyPass /Shibboleth.sso !<br>
> ProxyPass / ${APPLICATION_ENDPOINT}<br>
> ProxyPassReverse /Shibboleth.sso !<br>
> ProxyPassReverse / ${APPLICATION_ENDPOINT}<br>
> RequestHeader set cn "%{cn}e"<br>
> RequestHeader set firstname "%{firstname}e"<br>
> RequestHeader set lastname "%{lastname}e"<br>
> RequestHeader set email "%{email}e"<br>
> RequestHeader set uid "%{uid}e"<br>
> RequestHeader set displayname "%{displayname}e"<br>
><br>
> <Location /Shibboleth.sso><br>
> Satisfy Any<br>
> Allow from all<br>
> </Location><br>
><br>
> <Location /${PROTECTEDAPPROOT}><br>
> AuthType shibboleth<br>
> ShibRequestSetting requireSession 1<br>
> Require shib-attr displayname ${DISPLAYNAME}<br>
> </Location><br>
></VirtualHost><br>
><br>
>-----Original Message-----<br>
>From: users [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>] On Behalf Of Curry,<br>
>Warren<br>
>Sent: Tuesday, December 01, 2015 2:44 PM<br>
>To: Shib Users<br>
>Subject: RE: SAML Authentication using LDAP groups<br>
><br>
>It would seem that you want to do authorization against groups. Not<br>
>authentication with groups.<br>
><br>
>Why not make the LDAp groups an load an Attribute in you saml2 doc?<br>
>Tthis can then be used to determine authorization..<br>
><br>
>Perhaps I am missing something ...<br>
><br>
>whc<br>
><br>
>-----Original Message-----<br>
>From: users [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>] On Behalf Of Cahill,<br>
>Charles (GE Appliances)<br>
>Sent: Tuesday, December 01, 2015 10:59 AM<br>
>To: Shib Users <users@shibboleth.net><br>
>Subject: RE: SAML Authentication using LDAP groups<br>
><br>
>I am also wondering, could this be handled on the Apache SP side in the<br>
>conf file handling Location information?<br>
><br>
>-----Original Message-----<br>
>From: Cahill, Charles (GE Appliances)<br>
>Sent: Tuesday, December 01, 2015 10:24 AM<br>
>To: Shib Users<br>
>Subject: SAML Authentication using LDAP groups<br>
><br>
>Hey All:<br>
><br>
> I am looking to do something I believe is unique here with Shibboleth<br>
>and need some help to<br>
> Understand if it is possible.<br>
><br>
> I need Shibboleth to do Authentication against LDAP groups. The<br>
>challenge is that LDAP groups<br>
> contain DN's, not UID information, so the UID must first be gathered and<br>
>the DN pulled out. <br>
> The groups branch must then be searched with that DN to see what groups<br>
>the user is a member of.<br>
> The authentication would then need to be done against that information.<br>
>We are doing something<br>
> Similar with authorization and the code is below. My question is, can<br>
>scripts be used in the login.config<br>
> to do something along these lines or are scripts not able to be used<br>
>there. I would think I need to use<br>
> requisite and required login modules to make this work as well maybe<br>
>with some variables.<br>
><br>
> Here is our authorization methodology for returning the displayname of a<br>
>group as a header. I need<br>
> Not to return this header in some instances but to be able to do full<br>
>authentication based on group membership.<br>
><br>
> <!--ODSEE LDAP Groups Connector Configs--><br>
> <resolver:DataConnector id="slapd-xxxx-user-groups"<br>
>xsi:type="dc:LDAPDirectory"<br>
> ldapURL="ldaps://xxxxx ldaps://xxxxx"<br>
> principalCredential="xxxxx"<br>
> principal="xxxxx"<br>
> connectionStrategy="ACTIVE_PASSIVE"<br>
> maxResultSize="50"<br>
> mergeResults="true"<br>
> baseDN="ou=xxxxxgroups,ou=groups,o=xx.com"><br>
> <resolver:Dependency ref="slapd-xxx.xxx.xx.com" /><br>
> <resolver:Dependency ref="gexxxuid" /><br>
> <dc:FilterTemplate><br>
> <![CDATA[<br>
> (&(gexxxxxunit=Appliances)(uniquemember=gexxxuid=$gexxxuid.get(0),ou=ge<br>
>xxx,o=xx.com))<br>
> ]]><br>
> </dc:FilterTemplate><br>
> <dc:ReturnAttributes>displayname</dc:ReturnAttributes><br>
> <dc:LDAPProperty name="java.naming.ldap.factory.socket"<br>
>value="javax.net.ssl.SSLSocketFactory"/><br>
> <dc:ConnectionPool<br>
> minPoolSize="1"<br>
> maxPoolSize="8"<br>
> blockWhenEmpty="true"<br>
> blockWaitTime="PT5S"<br>
> expirationTime="PT10M"/><br>
> </resolver:DataConnector><br>
>--<br>
>To unsubscribe from this list send an email to<br>
>users-unsubscribe@shibboleth.net<br>
>-- <br>
>To unsubscribe from this list send an email to<br>
>users-unsubscribe@shibboleth.net<br>
>-- <br>
>To unsubscribe from this list send an email to<br>
>users-unsubscribe@shibboleth.net<br>
<br>
-- <br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</div>
</blockquote>
</div>
</body>
</html>