<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> I’m using IDP 3.2.0. It is possible for the IDP to control user access to an SP based on the attribute values of the user? This article seems to indicate that that can be done.<o:p></o:p></p>
<p class="MsoNormal"><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">But, when I just take the existing example and edit it slightly for our environment, I’m not seeing any conditions being applied against the attribute values. I don’t see anything in the logs regarding the intercept either. (I’m also
not sure which class to increase the logging for)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below are my changes. For testing, I’m looking to deny users to WebEx based on attribute value “uid”… in this case, all users would be denied.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND"><o:p></o:p></p>
<p class="MsoNormal"> <constructor-arg><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="shibboleth.Conditions.RelyingPartyId" c: candidates="#{
<span style="background:yellow;mso-highlight:yellow">'https://tufts-test.webex.com'</span> }" /><o:p></o:p></p>
<p class="MsoNormal"> <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"<o:p></o:p></p>
<p class="MsoNormal"> p:useUnfilteredAttributes="true"><o:p></o:p></p>
<p class="MsoNormal"> <property name="attributeValueMap"><o:p></o:p></p>
<p class="MsoNormal"> <map><o:p></o:p></p>
<p class="MsoNormal"> <entry key<span style="background:yellow;mso-highlight:yellow">="uid"></span><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <value><span style="background:yellow;mso-highlight:yellow">FAKE</span></value><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </entry><o:p></o:p></p>
<p class="MsoNormal"> </map><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </constructor-arg><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">-PQ<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>