<div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi Scott:</div><div><br></div><div>Thank you :)</div><div><br></div><div>I have AccessByUser working for all (while keeping the Status check by IP Address)--  running into a roadblock with AccessByAttribute.</div><div><br></div><div>I have the groupMembership value 'obfuscated' ---  receiving access denied messaging when attempting resolvertest, reload-service-configuration etc.</div><div><br></div><div>Have I missed anything obvious?</div><div><br></div><div><br></div><div><b>1 - admin/general-admin.xml</b><br></div><div><util:list id="shibboleth.AvailableAdminFlows"><br>    <br>        <!-- Status Page --><br>        <bean parent="shibboleth.AdminFlow"<br>            c:id="<a href="http://shibboleth.net/ns/profiles/status">http://shibboleth.net/ns/profiles/status</a>"<br>            p:loggingId="%{idp.service.logging.status:Status}"<br>            p:policyName="%{idp.status.accessPolicy:AccessByIPAddress}" /><br><br>        <!-- Service Reload --><br>        <bean parent="shibboleth.AdminFlow"<br>            c:id="<a href="http://shibboleth.net/ns/profiles/reload-service-configuration">http://shibboleth.net/ns/profiles/reload-service-configuration</a>"<br>            p:authenticated="true"<br>            p:loggingId="%{idp.service.logging.serviceReload:Reload}"<br>            p:policyName="%{idp.reload.accessPolicy:AccessByAttribute}" /><br><br>        <!-- MetadataResolver Reload --><br>        <bean parent="shibboleth.AdminFlow"<br>            c:id="<a href="http://shibboleth.net/ns/profiles/reload-metadata">http://shibboleth.net/ns/profiles/reload-metadata</a>"<br>            p:authenticated="true"<br>            p:loggingId="%{idp.service.logging.serviceReload:Reload}"<br>            p:policyName="%{idp.reload.accessPolicy:AccessByAttribute}" /><br><br>        <!-- AttributeResolver Debugging --><br>        <bean parent="shibboleth.AdminFlow"<br>            c:id="<a href="http://shibboleth.net/ns/profiles/resolvertest">http://shibboleth.net/ns/profiles/resolvertest</a>"<br>            p:authenticated="true"<br>            p:loggingId="%{idp.service.logging.resolvertest:ResolverTest}"<br>            p:policyName="%{idp.resolvertest.accessPolicy:AccessByAttribute}" /><br><br>        <!-- REST StorageService Access --><br>        <bean parent="shibboleth.AdminFlow"<br>            c:id="<a href="http://shibboleth.net/ns/profiles/storage">http://shibboleth.net/ns/profiles/storage</a>"<br>            p:authenticated="true"<br>            p:loggingId="Storage"<br>            p:policyName="AccessByAttribute" /><br>    <br>        <!-- REST Interface to Metrics --><br>        <bean parent="shibboleth.AdminFlow"<br>            c:id="<a href="http://shibboleth.net/ns/profiles/metrics">http://shibboleth.net/ns/profiles/metrics</a>"<br>            p:loggingId="Metrics"<br>            p:policyNameLookupStrategy-ref="shibboleth.metrics.AccessPolicyStrategy" /><br>    <br>    </util:list></div><div><br></div><div><br></div><div><b>2 - access-control.xml</b></div><div><br></div><div><util:map id="shibboleth.AccessControlPolicies"><br>    <br>        <entry key="AccessByIPAddress"><br>            <bean id="AccessByIPAddress" parent="shibboleth.IPRangeAccessControl"<br>                p:allowedRanges="#{ {'<a href="http://127.0.0.1/32">127.0.0.1/32</a>', '::1/128'} }" /><br>        </entry><br>        <br>        <br>        <entry key="AccessByUser"><br>            <bean parent="shibboleth.PredicateAccessControl"><br>                <constructor-arg><br>                    <bean parent="shibboleth.Conditions.SubjectName" c:collection="#{'lille'}" /><br>                </constructor-arg><br>            </bean><br>        </entry><br>       <br>        <br>        <entry key="AccessByAttribute"><br>            <bean parent="shibboleth.PredicateAccessControl"><br>                <constructor-arg><br>                    <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"><br>                        <property name="attributeValueMap"><br>                            <map><br>                                <entry key="groupMember"><br>                                    <list><br>                                        <value>obfuscated</value><br>                                    </list><br>                                </entry><br>                            </map><br>                        </property><br>                    </bean><br>                </constructor-arg><br>            </bean><br>        </entry><br>       <br>    <br>    </util:map><br></div><div><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 29, 2019 at 4:51 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> How do I configure for authenticated access to admin functions (beyond<br>
> uncommenting AccessByUser or AccessByAttribute)?<br>
<br>
Authentication can be added in general-admin.xml, the flow descriptor beans have an "authenticated" property to control that. One or two of them already are marked that way.<br>
<br>
> Is it possible to restrict access by either conditions matched:<br>
> AccessByIPAddress or AccessByUser or AccessByAttribute?<br>
<br>
They're (wrappers around) Predicates, you can do anything you want. Those are examples, nothing more.<br>
<br>
-- Scott<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>