<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This worked great! For the list archives, I made the following configuration:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
conf/intercept/context-check-intercept-config.xml:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> <bean id="shibboleth.context-check.Condition" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate" p:useUnfilteredAttributes="true"><br>
</span>
<div> <property name="attributeValueMap"><br>
</div>
<div> <map><br>
</div>
<div> <entry key="context_check"><br>
</div>
<div> <list><br>
</div>
<div> <value>1</value><br>
</div>
<div> </list><br>
</div>
<div> </entry><br>
</div>
<div> </map><br>
</div>
<div> </property><br>
</div>
<div> </bean><br>
</div>
<span></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
conf/attribute-resolver.xml:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> <AttributeDefinition id="context_check" xsi:type="ScriptedAttribute"><br>
</span>
<div> <InputDataConnector ref="ONIDLDAP" attributeNames="ismemberof" /><br>
</div>
<div> <Script><![CDATA[<br>
</div>
<div> logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.check_context");<br>
</div>
<div> rpid = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();<br>
</div>
<div> logger.debug("rpid=" + rpid);<br>
</div>
<div> access = "0";<br>
</div>
<div><br>
</div>
<div> // Lynda<br>
</div>
<div> if (rpid.equals("https://shib.lynda.com/shibboleth-sp")) {<br>
</div>
<div> for (i=0; i < ismemberof.getValues().size(); i++) {<br>
</div>
<div> tmp = ismemberof.getValues().get(i);<br>
</div>
<div> if (tmp.toLowerCase().equals("cn=lynda-eligible,ou=lynda,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu")) {<br>
</div>
<div> logger.debug("Access granted to Lynda");<br>
</div>
<div> access = "1";<br>
</div>
<div> }<br>
</div>
<div> }<br>
</div>
<div> }<br>
</div>
<span></span> ... else if other RPs ...</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span> // All others, grant access<br>
</span>
<div> else {<br>
</div>
<div> access = "1";<br>
</div>
<div> }<br>
</div>
<div><br>
</div>
<div> context_check.addValue(access);<br>
</div>
<div> logger.debug("context_check final value: " + context_check.getValues().get(0));<br>
</div>
<div> ]]></Script><br>
</div>
<div> </AttributeDefinition><br>
</div>
<span></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Anytime I want a new access check, I modify this scripted attribute and reload it.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of John C. Pfeifer <pfeifer@umd.edu><br>
<b>Sent:</b> Tuesday, January 14, 2020 5:30 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: How to use shibboleth.context-check.Function</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Move the scripted part to the attribute-resolver.xml (I have an attribute definition called authorizedUser) since that file is reloadable. My conf/intercept/context-check-intercept-config.xml then looks like:<br>
<br>
<util:map id="context-check.Map"><br>
<entry key="authorizedUser" value="*" /><br>
</util:map><br>
<br>
<bean id="shibboleth.context-check.Condition" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"<br>
p:useUnfilteredAttributes="true"<br>
p:attributeValueMap-ref="context-check.Map" /><br>
<br>
<br>
> On Jan 13, 2020, at 8:22 PM, Morgan, Andrew Jason <morgan@oregonstate.edu> wrote:<br>
> <br>
> We have some services that won't do their own authorization, so we have multiple context checkers in Shibboleth. Each of them checks for membership in an access group, like this:<br>
> <br>
> <bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND"><br>
> <constructor-arg><br>
> <list><br>
> <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="<a href="https://services.box.com/sp">https://services.box.com/sp</a>" /><br>
> <bean class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"<br>
> p:useUnfilteredAttributes="true"<br>
> p:attributeId="ismemberof"<br>
> p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" /><br>
> </list><br>
> </constructor-arg><br>
> </bean><br>
> <br>
> It's been on my list to investigate shibboleth.context-check.Function to simplify this.<br>
> <br>
> I think I can replace it with the following:<br>
> <br>
> <util:map id="ConditionMap"><br>
> <entry key="<a href="https://services.box.com/sp">https://services.box.com/sp</a>"><br>
> <ref bean="box-access-condition"/><br>
> </entry><br>
> </util:map><br>
> <br>
> <bean id="box-access-condition" class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"<br>
> p:useUnfilteredAttributes="true"<br>
> p:attributeId="ismemberof"<br>
> p:pattern="(?i)cn=eligible,ou=box,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu" /><br>
> <br>
> <bean id="shibboleth.context-check.Function" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<br>
> p:customObject-ref="ConditionMap"><br>
> <constructor-arg><br>
> <value><br>
> <![CDATA[<br>
> var event = "proceed";<br>
> var rpid = input.getSubcontext(<br>
> "net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();<br>
> var condition = custom.get(rpid);<br>
> if (condition != null && !condition.apply(input)) {<br>
> event = "ContextCheckDenied";<br>
> }<br>
> event;<br>
> ]]><br>
> </value><br>
> </constructor-arg><br>
> </bean><br>
> <br>
> Is that correct?<br>
> <br>
> Is it possible to define the ConditionMap in a way that won't require me to restart Shibboleth when I make a change?<br>
> <br>
> Thanks,<br>
> Andy Morgan<br>
> Identity & Access Management<br>
> Oregon State University<br>
> -- <br>
> For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
> To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
<br>
<br>
//<br>
John Pfeifer<br>
Division of Information Technology<br>
University of Maryland, College Park<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>