<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello</p>
<p>I want to deny access to a specific SP to users whose ldap
resolved attribute contains specific values and allow for other
values<br>
</p>
<p>in my case specific SP is entityID <i><a class="moz-txt-link-freetext" href="https://sp.im.fr/sp">https://sp.im.fr/sp</a></i>
and attribute is <i>eduPersonPrimaryAffiliation</i> which should
be = to "staff" or "employee" to be allowed access, if a value of
"student" is resolved (or others as affiliate,member ...) , access
to the SP should be denied .<br>
</p>
<p>So I have created a RelyingPartyOverrides in relaying-party.xml
with activationCondition based on the value of the attribute for
that specific relyingParty, the code is loaded (IDP starts well,
it took me a while with lots of errors ...) , now users can
connect , but also users with eduPersonPrimaryAffiliation that are
different from staff or employee in my case [1] :-( <br>
</p>
<p>I guess that my IdP (v5.1.6) does not deny access when my
relying-party activationCondition evaluates to false, and then it
might falls back to the default relying-party config with the
default SAML2 SSO profile which is not restricted !? <br>
</p>
<p>can you help me buiding an operational configuration that allow
access to that specific SP only for users whose <i>eduPersonPrimaryAffiliation
= staff or employee </i>? <br>
</p>
<p>is relying-party.xml the right place to do that, or
access-control.xml file should be involved ? <br>
</p>
<p>regard</p>
<p>jehan<br>
</p>
<p><i><font size="2"> <util:list id="<b>shibboleth.RelyingPartyOverrides</b>"><br>
</font></i></p>
<p><font size="2"><i> <bean id="MistralAI"
parent="RelyingPartyByName" <b>c:relyingPartyIds="#{{'<a class="moz-txt-link-freetext" href="https://sp.im.fr/sp">https://sp.im.fr/sp</a>'}}"</b>><br>
<br>
<property name="<b>activationCondition</b>"><br>
<bean parent="<b>shibboleth.Conditions.SimpleAttribute</b>"><br>
<property name="attributeValueMap"><br>
<map><br>
<entry key="<b>eduPersonPrimaryAffiliation</b>"><br>
<list><br>
<value><b>staff</b></value> </i></font></p>
<p><font size="2"><i>
<value>employee</value></i></font></p>
<p><font size="2"><i> </list><br>
</entry><br>
</map><br>
</property><br>
</bean><br>
</property> <br>
<br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"<br>
p:encryptAssertions="false"<br>
p:checkAddress="false" /><br>
</list><br>
</property><br>
<br>
</bean></i><br>
</font><br>
</p>
</body>
</html>