<div dir="ltr"><div>Hello,</div><div>I am having issues getting ContextCheckInterceptConfiguration working on 5 using (tier/shib-idp:5.0.0_20230914).</div><div><br></div><div>From the docs it seems like this context-check-intercept-config.xml [2] should work but it does not seem to be evaluating the relying party correctly and hence the flow continues when it should not. Interestingly, I was able to get it working when I moved the script in the attribute-filter.xml like in this older thread [1] but I would like to use the Function and show the user a IDP ContextCheckDenied error instead of from the SP. <br></div><div><br></div><div>thanks for any help!</div><div><br></div><div>mark</div><div><div>[1] <a href="https://shibboleth.net/pipermail/users/2020-January/045854.html">https://shibboleth.net/pipermail/users/2020-January/045854.html</a></div><div>[2] sanitized context-check-intercept-config.xml:</div></div><div><br></div><div><?xml version="1.0" encoding="UTF-8"?><br><beans xmlns="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>"<br>       xmlns:context="<a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>"<br>       xmlns:util="<a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>"<br>       xmlns:p="<a href="http://www.springframework.org/schema/p">http://www.springframework.org/schema/p</a>"<br>       xmlns:c="<a href="http://www.springframework.org/schema/c">http://www.springframework.org/schema/c</a>"<br>       xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br>       xsi:schemaLocation="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br>                           <a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a><br>                           <a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br>                           <br>       default-init-method="initialize"<br>       default-destroy-method="destroy"><br><br>    <util:map id="ConditionMap"><br>        <entry key='<a href="https://some-test-server.edu">https://some-test-server.edu</a>'><br>            <ref bean="moo-access-condition"/><br>        </entry><br>    </util:map><br><br>    <bean id="moo-access-condition" class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"<br>                            p:useUnfilteredAttributes="true"<br>                            p:attributeId="eduPersonAssurance"<br>                            p:pattern="(?i)some_value" /><br><br>    <bean id="shibboleth.context-check.Function" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<br>            p:customObject-ref="ConditionMap"><br>        <constructor-arg><br>            <value><br>            <![CDATA[<br>            var rpid = input.ensureSubcontext("net.shibboleth.profile.context.RelyingPartyContext").getRelyingPartyId();<br>            var condition = custom.get(rpid);<br>            if (condition != null && !condition.test(input)) {<br>                event = "ContextCheckDenied";<br>            }<br>            event;<br><br>            ]]><br>            </value><br>        </constructor-arg><br>    </bean><br></beans></div><div><br></div><div><br></div><div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><pre cols="72"><font face="arial, helvetica, sans-serif">Mark Y. Goh (he/him), Site Reliability Engineer, California College of the Arts, <a href="mailto:mgoh@cca.edu" target="_blank">mgoh@cca.edu</a></font><span></span><br></pre></div></div></div></div>