<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0">Juan,</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">Yes, it's possible. The easiest way is to write a ContextCheckIntercept with a check for that attribute with that value exposed by the attribute resolver.</p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0"><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration" class="OWAAutoLink" id="LPlnk472486" previewremoved="true">https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration</a></p>
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<p style="margin-top:0;margin-bottom:0">The example configuration should be directly helpful for you.<br>
<br>
Hope this helps too,</p>
<p style="margin-top:0;margin-bottom:0">Nate.</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Juan Padilla <juan.padilla@nxp.com><br>
<b>Sent:</b> Wednesday, June 13, 2018 12:56:16 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> force login failure based on attribute value</font>
<div> </div>
</div>
<meta content="text/html; charset=us-ascii">
<meta name="x_Generator" content="Microsoft Word 15 (filtered medium)">
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:x_link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
a:x_visited, span.x_MsoHyperlinkFollowed
{color:#954F72;
text-decoration:underline}
span.x_EmailStyle17
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-family:"Calibri",sans-serif}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="x_WordSection1">
<p class="x_MsoNormal">Is there a way to add logic in attribute-resolver (or other method) to not send the user back to the SP on successful login if an attribute is a certain value?</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">For example, if user is not part of an ldap group then send to an error page instead of the service provider.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Thanks.</p>
</div>
</div>
</body>
</html>