<div dir="ltr"><div class="gmail_default" style="font-family:georgia,serif">Hi Michael,</div><div class="gmail_default" style="font-family:georgia,serif"><br>Thanks for your reply. I really appreciate it.</div><div class="gmail_default" style="font-family:georgia,serif">The container config burn-in doesn't have access-control as one of the items that are available, at least in the vanilla build from/for InCommon.</div><div class="gmail_default" style="font-family:georgia,serif">I'll see if I can find more about InCommon's config burn-in, but I may have to just try to connect to SAML as my validation test.</div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><p style="background-image:initial;background-position:initial;background-repeat:initial"><b><span style="font-family:Arial,sans-serif;color:rgb(102,102,102);background-image:initial;background-position:initial;background-repeat:initial">David Dellinger </span></b><span style="font-family:Arial,sans-serif;color:rgb(102,102,102);background-image:initial;background-position:initial;background-repeat:initial">| Sr. Systems Administrator</span><span style="font-family:Arial,sans-serif;color:rgb(89,89,89);background-image:initial;background-position:initial;background-repeat:initial"><br></span><b><span style="font-family:Arial,sans-serif;color:rgb(255,153,0)">Information Technology Services<br></span></b><span style="font-family:Arial,sans-serif;color:rgb(89,89,89)"><a href="mailto:ddellinger@oxy.edu" target="_blank">ddellinger@oxy.edu</a> </span><span style="font-family:Arial,sans-serif;color:rgb(102,102,102)">| T 323-259-1315</span><b><span style="font-family:Arial,sans-serif;color:rgb(255,153,0)"></span></b></p><p style="margin:0in 0in 0.0001pt;font-size:11pt;font-family:Calibri,sans-serif"></p><p style="background-image:initial;background-position:initial;background-repeat:initial"><b><span style="font-family:Arial,sans-serif;color:rgb(255,153,0);background-image:initial;background-position:initial;background-repeat:initial">OXY</span></b><b><span style="font-family:Arial,sans-serif;color:rgb(102,102,102);background-image:initial;background-position:initial;background-repeat:initial"> </span></b><b><span style="font-family:Arial,sans-serif;color:rgb(102,102,102);background-image:initial;background-position:initial;background-repeat:initial">Occidental College<br></span></b><span style="font-family:Arial,sans-serif;color:rgb(102,102,102)">Mary Norton Clapp Library | 1600 Campus Road  |  Los Angeles, California 90041<br></span><span style="font-family:Arial,sans-serif"><a href="http://oxy.edu/its" target="_blank">oxy.edu/its</a><span> </span></span></p></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Aug 14, 2023 at 8:00 AM Michael Young <<a href="mailto:m.a.young@durham.ac.uk">m.a.young@durham.ac.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
<br>
On Fri, 11 Aug 2023, David Dellinger wrote:<br>
<br>
> Thanks Paul,<br>
> <br>
> I get the same result using curl from the VM that is running the Shibboleth<br>
> container.<br>
> <br>
> $ curl --insecure <a href="https://localhost/idp/status" rel="noreferrer" target="_blank">https://localhost/idp/status</a><br>
> .snip<br>
>         <div class="content"><br>
> You do not have access to the requested resource.            </div><br>
> .snip<br>
> <br>
> I'm reading through the step-by-step that you sent, and am looking at the<br>
> samltest site. Thanks!<br>
<br>
Access to the idp status is controlled by the conf/access-control.xml <br>
file, where there will be a line like<br>
      p:allowedRanges="#{ {'<a href="http://127.0.0.1/32" rel="noreferrer" target="_blank">127.0.0.1/32</a>', '::1/128'} }" /><br>
<br>
so you need to work out the address shibboleth is seeing (eg. from the <br>
jetty or tomcat logs) and add that to the line.<br>
<br>
        Michael Young</blockquote></div>