<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
In a normal situation yes we'd like to tell the users why its
failing, in this particular project though, a failed login with no
explanation is fine. <br>
<br>
I was trying to do something like both you and Scott mentioned,
changing the LDAP search filter to only allow access if they're in a
certain group. This is shibboleth idp 3.3.1 BTW. <br>
<br>
Right now I have this as my CDATA section within my DataConnector
which successfully matches on the mail attribute. The CDATA values
are actually a variable %{idp.attribute.resolver.LDAP.searchFilter}
in attribute-resolver.xml but these are the values it should be
reading when it runs.<br>
<br>
This is successfully authenticating:<br>
<br>
<FilterTemplate><br>
<![CDATA[<br>
(mail=$requestContext.principalName)<br>
]]><br>
</FilterTemplate><br>
<br>
I tried this next line but it didnt seem to work, users not in the
group are able to login:<br>
<br>
<FilterTemplate><br>
<![CDATA[<br>
(&(mail=$requestContext.principalName)(memberOf=CN=MyGroup,CN=Users,DC=school,DC=net))<br>
]]><br>
</FilterTemplate><br>
<br>
Should that work? <br>
<br>
Thanks<br>
Dan<br>
<br>
<br>
<div class="moz-cite-prefix">On 05/02/2017 07:21 PM, IAM David Bantz
wrote:<br>
</div>
<blockquote
cite="mid:CAJ9XvwFAj5THf1rfMoQ7r-BfhA71JeN4P+eDfwef6LSxW+M30A@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div dir="ltr">Shibb developers have built in enormous flexibility
into the IdP so you no doubt implement such a restriction in the
IdP, the simplest way I thought of is Scott's, including the
membership in the LDAP search during the initial authentication
(if using jaas.config, userFilter="(&(<span
style="font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0);font-family:menlo">sAMAccountName</span>={user})(memberOf=CN=MyGroup,<wbr>CN=Users,DC=umass,DC=net)".
<div><br>
</div>
<div>One issue is that that tactic in itself will result in
failed authentication if the user isn't in the group, without
indication to user of why or what to do about it. </div>
<div><br>
</div>
<div>Wouldn't it be preferable to have the IdP release an
appropriate set of memberOf values to the SP, and let the SP
do authorization and respond appropriately to the user: "You
authenticated, but you do not have access to this service;
here's why or what you do about that..."?</div>
<div><br>
</div>
<div>David Bantz</div>
<div>UA OIT IAM</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, May 2, 2017 at 3:10 PM, Cantor,
Scott <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"><span
class="">On 5/2/17, 6:36 PM, "users on behalf of Daniel
McDonald" <<a moz-do-not-send="true"
href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>
on behalf of <a moz-do-not-send="true"
href="mailto:daniel.mcdonald@umb.edu">daniel.mcdonald@umb.edu</a>>
wrote:<br>
<br>
> We'd like to limit who's logging into shibboleth
based on not only their<br>
> password, but if they're in a group as well.<br>
<br>
</span>Then why don't you change your LDAP filter in the
authentication check to exclude entries that aren't in the
group?<br>
<span class=""><br>
> I can return the "memberOf" attribute with a list of
the users groups. I<br>
> hoped that putting this in the ldap search filter
would work but it didnt:<br>
<br>
</span>That looks like it's from the attribute resolver. How
would that impact authentication?<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span>
<div class="HOEnZb">
<div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a
moz-do-not-send="true"
href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>