<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>ok, forget my question about "<i>if entry key="sp_entity_id_1"
should be replaced with the real EntityIDs concerned</i>" (in
message below which wasn't post to the list because of a wrong
sender email address which is not subscribed to the list ...) <br>
</p>
<p>of course ... I did it, <i><font size="2"><<b>entry key="</b></font></i><i><font
size="2"><a class="moz-txt-link-abbreviated"
href="mailto:first.last@im.fr|https://cool-mist/self-service/methods/saml/organizations/orgid|_c769e04b0a02a02569f8babf4beca95a|password|2025-12-08T17:02:07.580Z|uid,eduPersonPrimaryAffiliation,mail,eduPersonAffiliation,givenName,schacHomeOrganization,eduPersonPrincipalName,sn|first.last@im.fr|emailAddress|false|true||Redirect|POST||Success||19b908c49d7ec7cb925700ad266e0cf9f008ee292dbf9bcc79fb0c2e20074360|Mozilla/5.0">https://cool-mist/self-service/methods/saml/organizations/orgid</a></font></i><i><font
size="2"><b>"</b>></font></i></p>
<p>and now access control works as expected <br>
</p>
<p><font size="2"><i>2025-12-08 18:50:05,221 - 157.157.2.2 - INFO
[Shibboleth-Audit.SSO:333] -
157.157.2.2|2025-12-08T17:49:59.876564883Z,2025-12-08T17:49:57.375970590Z|2025-12-08T17:50:05.221062518Z|</i></font><i><font
size="2"><a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:first.last@im.fr">first.last@im.fr</a></font></i><font
size="2"><i>|</i></font><i><font size="2"><a
class="moz-txt-link-abbreviated"
href="mailto:first.last@im.fr|https://cool-mist/self-service/methods/saml/organizations/orgid|_c769e04b0a02a02569f8babf4beca95a|password|2025-12-08T17:02:07.580Z|uid,eduPersonPrimaryAffiliation,mail,eduPersonAffiliation,givenName,schacHomeOrganization,eduPersonPrincipalName,sn|first.last@im.fr|emailAddress|false|true||Redirect|POST||Success||19b908c49d7ec7cb925700ad266e0cf9f008ee292dbf9bcc79fb0c2e20074360|Mozilla/5.0">https://cool-mist/self-service/methods/saml/organizations/orgid</a></font></i><font
size="2"><i>|||||||<b>false|true||Redirect</b>||<b>ContextCheckDenied</b>|||19b908c49d7ec7cb925700ad266e0cf9f008ee292dbf9bcc79fb0c2e20072576|Mozilla/5.0
(X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/140.0.0.0 Safari/537.36</i></font></p>
<p>Thanks.</p>
<p>jehan<font size="2"><i><br>
</i></font></p>
<div class="moz-cite-prefix">On 08/12/2025 18:45, jehan Procaccia
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:be68c1d5-051b-4925-98ba-71c608bb6f11@imtbs-tsp.eu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Thanks for that confirmation to use <a
href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration"
target="_blank" moz-do-not-send="true">ContextCheckInterceptConfiguration</a></p>
<p>I tried to use you example of config, everything went right for
a user connection, except that the user has attribute = staff
and I wanted in that sample usecase only attribute = student ,
so the user was allowed access and not denied as expected :-(
(idp logs bellow [1] <br>
</p>
<p>I wonder if I have well interpreted your sample config , I
particularly wonder if entry <i>key="sp_entity_id_1"</i> should
be replaced with the real EntityIDs concerned ? <br>
</p>
<p>Here is what I took/change from your sample, </p>
<p>1) relying-party.xml with my SP entityID as a Overrides : <br>
</p>
<p><i><font size="2"> <bean id="MistralAI"
parent="RelyingPartyByName"
c:relyingPartyIds="#{{'<a class="moz-txt-link-freetext"
href="https://cool-mist/self-service/methods/saml/organizations/orgid"
moz-do-not-send="true">https://cool-mist/self-service/methods/saml/organizations/orgid</a>'}}"></font></i></p>
<p><i><font size="2"> <property
name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"<br>
p:encryptAssertions="false"<br>
<b>p:postAuthenticationFlows="#{{'context-check'}}"</b><br>
p:checkAddress="false" />
</list></property></bean></font></i></p>
<p>2) Then in <i><font size="2">conf/intercept/context-check-intercept-config.xml<br>
</font></i></p>
<p><i><font size="2"><bean <b>id="OnlyMistralAI" </b>parent="shibboleth.Conditions.SimpleAttribute"
p:useUnfilteredAttributes="true"><br>
<property name="attributeValueMap"><br>
<map><br>
<entry key=<b>"eduPersonPrimaryAffiliation"</b>><br>
<list><br>
<value><b>student</b></value><br>
</list> </entry> </map>
</property></bean></font></i></p>
<p><i><font size="2"><!-- Map associating each SP entity id to
its access condition. --><br>
<util:map id="ConditionMap"><br>
<<b>entry key="sp_entity_id_1"</b>> <br>
<ref bean="OnlyAdmin"/><br>
</entry><br>
<<b>entry key="sp_entity_id_2"</b>> => shoudl
it contain the real EntityID ? here </font></i><i><font
size="2"><a class="moz-txt-link-freetext"
href="https://cool-mist/self-service/methods/saml/organizations/orgid"
moz-do-not-send="true">https://cool-mist/self-service/methods/saml/organizations/orgid</a></font></i><br>
<i><font size="2"> <ref bean="OnlyMistralAI"/><br>
</entry><br>
</util:map></font></i><br>
<br>
the final part <br>
</p>
<p><font size="2"> <i><!-- Bean checking the access condition
for each SP entity id --><br>
<bean id="shibboleth.context-check.Function"
parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"<br>
c:outputType="java.lang.String"
p:customObject-ref="ConditionMap"> ....</i></font><br>
</p>
<p>was taken as it, without any change from yours . <br>
</p>
<p>Thanks for you help . <br>
</p>
<p>Regards <br>
</p>
<p>jehan<br>
</p>
<p>[1] IDP logs while <i><font size="2"><a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:first.last@im.fr" moz-do-not-send="true">first.last@im.fr</a>
does connetcto SP alhtougth he as staff attribute vs student
which was expeted in that config , note also that this IDP
is functionning a an proxy IDP so that I can benefit from ou
Discovery Service for our internal Federation, Vendor SP
here works only with a bilateral IDP, so attributes are
passingThrough, perhaps a missleading message below ? <br>
</font></i></p>
<p><i><font size="2">2025-12-08 18:18:30,803 - 157.157.2.2 - WARN
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:596] -
Attribute Resolver 'ShibbolethAttributeResolver': <b>could
not export attibute 'eduPersonPrimaryAffiliation' from
data connector 'passthroughAttributes' since an attribute
of that name already exists.</b><br>
2025-12-08 18:18:30,806 - 157.157.2.2 - WARN
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:596]
- Attribute Resolver 'ShibbolethAttributeResolver': could
not export attibute 'eduPersonAffiliation' from data
connector 'passthroughAttributes' since an attribute of that
name already exists.<b><br>
</b></font></i></p>
<p><i><font size="2">2025-12-08T17:18:32.070774542Z|<a
class="moz-txt-link-abbreviated moz-txt-link-freetext"
href="mailto:first.last@im.fr|https://cool-mist/self-service/methods/saml/organizations/orgid|_c769e04b0a02a02569f8babf4beca95a|password|2025-12-08T17:02:07.580Z|uid,eduPersonPrimaryAffiliation,mail,eduPersonAffiliation,givenName,schacHomeOrganization,eduPersonPrincipalName,sn|first.last@im.fr|emailAddress|false|true||Redirect|POST||Success||19b908c49d7ec7cb925700ad266e0cf9f008ee292dbf9bcc79fb0c2e20074360|Mozilla/5.0"
moz-do-not-send="true">first.last@im.fr|https://cool-mist/self-service/methods/saml/organizations/orgid|_c769e04b0a02a02569f8babf4beca95a|password|2025-12-08T17:02:07.580Z|uid,eduPersonPrimaryAffiliation,mail,eduPersonAffiliation,givenName,schacHomeOrganization,eduPersonPrincipalName,sn|first.last@im.fr|emailAddress|false|true||Redirect|POST||Success||19b908c49d7ec7cb925700ad266e0cf9f008ee292dbf9bcc79fb0c2e20074360|Mozilla/5.0</a>
(X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/140.0.0.0 Safari/537.36</font></i><br>
</p>
<p><i><font size="2"><br>
<br>
</font></i></p>
<p>On 08/12/2025 11:12, Gianluca Amato via users wrote:</p>
<blockquote type="cite"
cite="mid:CAPJun+Ay8H=jEajJdsUeLNCQqnJLnGH+7vSoSjzc+qP5C4SO_A@mail.gmail.com">
<meta http-equiv="content-type"
content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">
<div>I think the correct approach is to use a context-check
interceptor (<a
href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration</a>).</div>
<div><br>
</div>
<div>You need to first install the support with:<br>
<pre>bin/module.sh -e idp.intercept.ContextCheck</pre>
Then, you need to modify <code>conf/relying-party.xml </code>enabling
the post-authentication flow.</div>
<div>
<pre class="gmail-code gmail-xml"><span class="gmail-sc3"><span
class="gmail-re1"><bean</span> <span class="gmail-re0">parent</span>=<span
class="gmail-st0">"SAML2.SSO"</span> <span
class="gmail-re0">p:postAuthenticationFlows</span>=<span
class="gmail-st0">"#{{'context-check'}}"</span> <span
class="gmail-re0">p:encryptAssertions</span>=<span
class="gmail-st0">"false"</span> <span class="gmail-re2">/></span></span></pre>
Finally, create a file <em>conf/intercept/context-check-intercept-config.xml </em>with
the configuration. We use something liek the following:
<pre class="gmail-code gmail-xml"><span class="gmail-sc-1"><!-- Bean for restricting access to the admin user. --></span>
<span class="gmail-sc3"><span class="gmail-re1"><bean</span> <span
class="gmail-re0">id</span>=<span class="gmail-st0">"OnlyAdmin"</span> <span
class="gmail-re0">parent</span>=<span class="gmail-st0">"shibboleth.Conditions.SimpleAttribute"</span> <span
class="gmail-re0">p:useUnfilteredAttributes</span>=<span
class="gmail-st0">"true"</span><span class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><property</span> <span
class="gmail-re0">name</span>=<span class="gmail-st0">"attributeValueMap"</span><span
class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><map<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><entry</span> <span
class="gmail-re0">key</span>=<span class="gmail-st0">"uid"</span><span
class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><list<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><value<span
class="gmail-re2">></span></span></span>admin_uid<span
class="gmail-sc3"><span class="gmail-re1"></value<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></list<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></entry<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></map<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></property<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></bean<span
class="gmail-re2">></span></span></span>
<!-- Bean for restricting access to people with member affiliation. -->
<bean id="OnlyMembers" parent="shibboleth.Conditions.SimpleAttribute" p:useUnfilteredAttributes="true">
<property name="attributeValueMap">
<map>
<entry key="eduPersonAffiliation">
<list>
<value>member</value>
</list>
</entry>
</map>
</property>
</bean>
<span class="gmail-sc-1"><!-- Map associating each SP entity id to its access condition. --></span>
<span class="gmail-sc3"><span class="gmail-re1"><util:map</span> <span
class="gmail-re0">id</span>=<span class="gmail-st0">"ConditionMap"</span><span
class="gmail-re2">></span></span>
<entry key="sp_entity_id_1">
<ref bean="OnlyAdmin"/>
</entry>
<entry key="sp_entity_id_2">
<ref bean="OnlyMembers"/>
</entry>
<span class="gmail-sc3"><span class="gmail-re1"></util:map<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc-1"><!-- Bean checking the access condition for each SP entity id --></span>
<span class="gmail-sc3"><span class="gmail-re1"><bean</span> <span
class="gmail-re0">id</span>=<span class="gmail-st0">"shibboleth.context-check.Function"</span> <span
class="gmail-re0">parent</span>=<span class="gmail-st0">"shibboleth.ContextFunctions.Scripted"</span> <span
class="gmail-re0">factory-method</span>=<span
class="gmail-st0">"inlineScript"</span></span>
<span class="gmail-sc3"> <span class="gmail-re0">c:outputType</span>=<span
class="gmail-st0">"java.lang.String"</span> <span
class="gmail-re0">p:customObject-ref</span>=<span
class="gmail-st0">"ConditionMap"</span><span
class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><constructor-arg<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><value<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc2"><![CDATA[</span>
<span class="gmail-sc2"> var event = "proceed";</span>
<span class="gmail-sc2"> var rpid = input.getSubcontext(</span>
<span class="gmail-sc2"> "net.shibboleth.profile.context.RelyingPartyContext").getRelyingPartyId();</span>
<span class="gmail-sc2"> var condition = custom.get(rpid);</span>
<span class="gmail-sc2"> if (condition != null && !condition.test(input)) {</span>
<span class="gmail-sc2"> event = "ContextCheckDenied";</span>
<span class="gmail-sc2"> }</span>
<span class="gmail-sc2"> event;</span>
<span class="gmail-sc2"> ]]></span>
<span class="gmail-sc3"><span class="gmail-re1"></value<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></constructor-arg<span
class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></bean<span
class="gmail-re2">></span></span></span></pre>
<br>
</div>
<div>Best regards,</div>
<div>--gianluca</div>
<div><br>
</div>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Sun, Dec 7, 2025 at
7:15 PM <a href="mailto:jehan.procaccia@tem-tsp.eu"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">jehan.procaccia@tem-tsp.eu</a>
<<a href="mailto:jehan.procaccia@tem-tsp.eu"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">jehan.procaccia@tem-tsp.eu</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Hello</p>
<p>I want to deny access to a specific SP to users
whose ldap resolved attribute contains specific
values and allow for other values<br>
</p>
<p>in my case specific SP is entityID <i><a
href="https://sp.im.fr/sp" target="_blank"
moz-do-not-send="true"
class="moz-txt-link-freetext">https://sp.im.fr/sp</a></i>
and attribute is <i>eduPersonPrimaryAffiliation</i>
which should be = to "staff" or "employee" to be
allowed access, if a value of "student" is resolved
(or others as affiliate,member ...) , access to the
SP should be denied .<br>
</p>
<p>So I have created a RelyingPartyOverrides in
relaying-party.xml with activationCondition based on
the value of the attribute for that specific
relyingParty, the code is loaded (IDP starts well,
it took me a while with lots of errors ...) , now
users can connect , but also users with
eduPersonPrimaryAffiliation that are different from
staff or employee in my case [1] :-( <br>
</p>
<p>I guess that my IdP (v5.1.6) does not deny access
when my relying-party activationCondition evaluates
to false, and then it might falls back to the
default relying-party config with the default SAML2
SSO profile which is not restricted !? <br>
</p>
<p>can you help me buiding an operational
configuration that allow access to that specific SP
only for users whose <i>eduPersonPrimaryAffiliation
= staff or employee </i>? <br>
</p>
<p>is relying-party.xml the right place to do that, or
access-control.xml file should be involved ? <br>
</p>
<p>regard</p>
<p>jehan<br>
</p>
<p><i><font size="2"> <util:list id="<b>shibboleth.RelyingPartyOverrides</b>"><br>
</font></i></p>
<p><font size="2"><i> <bean
id="MistralAI" parent="RelyingPartyByName" <b>c:relyingPartyIds="#{{'<a
href="https://sp.im.fr/sp" target="_blank"
moz-do-not-send="true"
class="moz-txt-link-freetext">https://sp.im.fr/sp</a>'}}"</b>><br>
<br>
<property name="<b>activationCondition</b>"><br>
<bean parent="<b>shibboleth.Conditions.SimpleAttribute</b>"><br>
<property
name="attributeValueMap"><br>
<map><br>
<entry key="<b>eduPersonPrimaryAffiliation</b>"><br>
<list><br>
<value><b>staff</b></value> </i></font></p>
<p><font size="2"><i>
<value>employee</value></i></font></p>
<p><font size="2"><i>
</list><br>
</entry><br>
</map><br>
</property><br>
</bean><br>
</property> <br>
<br>
<property
name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"<br>
p:encryptAssertions="false"<br>
p:checkAddress="false" /><br>
</list><br>
</property><br>
<br>
</bean></i><br>
</font><br>
</p>
</div>
-- <br>
For Consortium Member technical support, see <a
href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw"
rel="noreferrer" target="_blank"
moz-do-not-send="true" class="moz-txt-link-freetext">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a
href="mailto:users-unsubscribe@shibboleth.net"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
</blockquote>
</body>
</html>