<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 4/17/17 4:53 PM, Yannick Béot wrote:<br>
</div>
<blockquote
cite="mid:CAMer1X79uEszXH4jMHOz=4+U4kuS3eqUJV2kznxykdy96Qky5g@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>Hi,<br>
<br>
</div>
That is the same kind of configuration I have tried and
that I had in mind.<br>
<br>
</div>
By using static value, it worked. For instance:<br>
<tt>require shib-attr orgunit XXX<br>
<br>
</tt></div>
I have to check the apache version though.<br>
</div>
</div>
</blockquote>
<br>
If the httpd is new enough for the match group to work, but if it
turns out that mod_shib doesn't do the expression parsing necessary,
then it might be possible to get the same effective config using the
more general 2.4 'Require expr' support [1], which can take any
valid expression [2]. This is off-the-cuff and untested, but
something like this might work:<br>
<br>
<br>
<tt><LocationMatch "^/(?<orgunit>[^/]+)/foo/bar"></tt><tt><br>
</tt><tt> require expr "%{env:orgunit} == %{env:MATCH_ORGUNIT}</tt><tt>"</tt><tt><br>
</tt><tt></LocationMatch></tt><br>
<br>
<br>
That's assuming the use of attributes as environment vars rather
than request headers, and that the attribute is "orgunit". (Or
maybe the env var would be something like HTTP_ORGUNIT, I can't keep
it all straight).<br>
<br>
<br>
<br>
[1] <a class="moz-txt-link-freetext" href="http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#reqexpr">http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#reqexpr</a><br>
<br>
[2] <a class="moz-txt-link-freetext" href="http://httpd.apache.org/docs/2.4/expr.html">http://httpd.apache.org/docs/2.4/expr.html</a><br>
</body>
</html>