<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We have some services that won't do their own authorization, so we have multiple context checkers in Shibboleth. Each of them checks for membership in an access group, like this:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> <bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND"><br>
</span>
<div> <constructor-arg><br>
</div>
<div> <list><br>
</div>
<div> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="https://services.box.com/sp" /><br>
</div>
<div> <bean class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"<br>
</div>
<div> p:useUnfilteredAttributes="true"<br>
</div>
<div> p:attributeId="ismemberof"<br>
</div>
<div> p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" /><br>
</div>
<div> </list><br>
</div>
<div> </constructor-arg><br>
</div>
<div> </bean><br>
</div>
<span></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It's been on my list to investigate shibboleth.context-check.Function to simplify this.<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I think I can replace it with the following:<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><util:map id="ConditionMap"><br>
</span>
<div> <entry key="<a href="https://services.box.com/sp">https://services.box.com/sp</a>"><br>
</div>
<div> <ref bean="box-access-condition"/><br>
</div>
<div> </entry><br>
</div>
<span style="font-family: "Arial Black", Arial, sans-serif;"></util:map></span><br>
</div>
<div><span style="font-family: "Arial Black", Arial, sans-serif;"><br>
</span></div>
<div><span style="font-family: "Arial Black", Arial, sans-serif;"><bean id="box-access-condition" class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div><span style="font-family: "Arial Black", Arial, sans-serif;"> p:useUnfilteredAttributes="true"</span><br>
</div>
<div> p:attributeId="ismemberof"<br>
</div>
<div> p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" /></div>
<span><br>
</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span><bean id="shibboleth.context-check.Function" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<br>
</span>
<div> p:customObject-ref="ConditionMap"><br>
</div>
<div> <constructor-arg><br>
</div>
<div> <value><br>
</div>
<div> <![CDATA[<br>
</div>
<div> var event = "proceed";<br>
</div>
<div> var rpid = input.getSubcontext(<br>
</div>
<div> "net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();<br>
</div>
<div> var condition = custom.get(rpid);<br>
</div>
<div> if (condition != null && !condition.apply(input)) {<br>
</div>
<div> event = "ContextCheckDenied";<br>
</div>
<div> }<br>
</div>
<div> event;<br>
</div>
<div> ]]><br>
</div>
<div> </value><br>
</div>
<div> </constructor-arg><br>
</div>
<span></bean></span><br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is that correct?<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is it possible to define the ConditionMap in a way that won't require me to restart Shibboleth when I make a change?</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div>
<div id="Signature">
<div></div>
<div></div>
<div style="font-family:"Courier New",monospace; font-size:12pt; color:rgb(0,0,0)">
<span style="font-family:Arial,Helvetica,sans-serif">Andy Morgan</span><span><br>
</span></div>
<div style="font-family:"Courier New",monospace; font-size:12pt; color:rgb(0,0,0)">
<div><span style="font-family:Arial,Helvetica,sans-serif">Identity & Access Management</span><br>
</div>
<div><span style="font-family:Arial,Helvetica,sans-serif">Oregon State University</span><br>
</div>
</div>
</div>
</div>
</body>
</html>