<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">If the "bottom line" is to prevent a given user from continuing to use the service, and you are using Apache HTTPD as a reverse proxy, couldn't you add in "negated" group authorization in addition to the Shib-based authz rules? I.e. don't allow access to anyone that is a member of this group? Using whatever approach the given version of the Shib SP, and of Apache HTTPD, you are using:<div class=""><br class=""></div><div class=""> <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig#NativeSPApacheConfig-AuthConfigOptions" class="">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig#NativeSPApacheConfig-AuthConfigOptions</a></div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 21, 2018, at 10:33 AM, Tom Noonan <<a href="mailto:tom@joinroot.com" class="">tom@joinroot.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">No worries, I appreciate the help in any case!</div><div class="gmail_extra" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br clear="all" class=""><div class=""><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr" class=""><div class=""><div dir="ltr" class=""><div class=""><span style="font-size: 12.8px;" class="">--Tom Noonan II</span><br class=""></div></div></div></div></div></div><br class=""><div class="gmail_quote">On Wed, Feb 21, 2018 at 11:30 AM, Peter Schober<span class="Apple-converted-space"> </span><span dir="ltr" class=""><<a href="mailto:peter.schober@univie.ac.at" target="_blank" class="">peter.schober@univie.ac.at</a>></span><span class="Apple-converted-space"> </span>wrote:<br class=""><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex;">* Tom Noonan <<a href="mailto:tom@joinroot.com" class="">tom@joinroot.com</a>> [2018-02-21 17:23]:<br class="">> I'm not using memcached. I think there is some confusion with another<br class="">> thread.<br class=""><br class="">Indeed, apologies. I was referring to a hijacked thread that at one<br class="">point changed its subject to "Shibboleth SP clustering using shared<br class="">database", where someone wanted to cluster Apache httpd with Shib as a<br class="">reverse proxy to another resource.<br class="">That latter part is what caused me to chase you down a road you had no<br class="">intention of going.<br class=""><span class="HOEnZb"><font color="#888888" class="">-peter<br class=""></font></span></blockquote></div></div></div></blockquote></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>