<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello!</p>
<p>Here we have used scripted attribute to accomplish something a
like that you want. In ldap we have defined an own attribute
called irfAuthorizedService. That contains values to what services
a user is allowed to login to. <br>
For example if the user is allowed to login to a chat service the
irfAuthorizedService contains value chat (in our case sso login to
slack).<br>
slack demands first_name. In attribute-filter.xml it looks like
this:<br>
<br>
<AttributeFilterPolicy id="slack"> <br>
<PolicyRequirementRule xsi:type="Requester"
value=<a class="moz-txt-link-rfc2396E" href="https://slack.com">"https://slack.com"</a> /> <br>
<AttributeRule attributeID="User_Email"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
<AttributeRule attributeID="User_Username"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
<AttributeRule attributeID="first_name"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
<AttributeRule attributeID="last_name"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> <br>
<AttributeRule attributeID="displayName"> <br>
<PermitValueRule xsi:type="ANY" /> <br>
</AttributeRule> </p>
<p></AttributeFilterPolicy><br>
<br>
In attribute-resolver.xml we release the attribute first_name for
a user if irfAuthorizedService contains chat as said like this:<br>
<br>
<AttributeDefinition xsi:type="ScriptedAttribute"
id="first_name" xmlns="urn:mace:shibboleth:2.0:resolver"> <br>
<InputDataConnector ref="myLDAP"
attributeNames="givenName" /> <br>
<InputDataConnector ref="myLDAP"
attributeNames="irfAuthorizedService" /> <br>
<AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:resolver" name="first_name"
friendlyName="first_name" /> <br>
<Script> <br>
<![CDATA[ <br>
if ((irfAuthorizedService) &&
(irfAuthorizedService.getValues().contains("chat"))) { <br>
first_name.getValues().add(givenName.getValues().get(0)); <br>
} <br>
]]> <br>
</Script> <br>
</AttributeDefinition><br>
<br>
However it's not so fancy that an own-defined error message comes
up (if the irfAuthorizedService doesn't contain chat) but we think
it's a rather simple solution.</p>
<p>/Regards Mats<br>
<br>
</p>
<div class="moz-cite-prefix">On 12/7/25 7:09 PM,
<a class="moz-txt-link-abbreviated" href="mailto:jehan.procaccia@tem-tsp.eu">jehan.procaccia@tem-tsp.eu</a> wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6dea2d17-7cf9-4bb2-ad77-2711ce12a035@tem-tsp.eu">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<p>Hello</p>
<p>I want to deny access to a specific SP to users whose ldap
resolved attribute contains specific values and allow for other
values<br>
</p>
<p>in my case specific SP is entityID <i><a
class="moz-txt-link-freetext" href="https://sp.im.fr/sp"
moz-do-not-send="true">https://sp.im.fr/sp</a></i> and
attribute is <i>eduPersonPrimaryAffiliation</i> which should be
= to "staff" or "employee" to be allowed access, if a value of
"student" is resolved (or others as affiliate,member ...) ,
access to the SP should be denied .<br>
</p>
<p>So I have created a RelyingPartyOverrides in relaying-party.xml
with activationCondition based on the value of the attribute for
that specific relyingParty, the code is loaded (IDP starts well,
it took me a while with lots of errors ...) , now users can
connect , but also users with eduPersonPrimaryAffiliation that
are different from staff or employee in my case [1] :-( <br>
</p>
<p>I guess that my IdP (v5.1.6) does not deny access when my
relying-party activationCondition evaluates to false, and then
it might falls back to the default relying-party config with the
default SAML2 SSO profile which is not restricted !? <br>
</p>
<p>can you help me buiding an operational configuration that allow
access to that specific SP only for users whose <i>eduPersonPrimaryAffiliation
= staff or employee </i>? <br>
</p>
<p>is relying-party.xml the right place to do that, or
access-control.xml file should be involved ? <br>
</p>
<p>regard</p>
<p>jehan<br>
</p>
<p><i><font size="2"> <util:list id="<b>shibboleth.RelyingPartyOverrides</b>"><br>
</font></i></p>
<p><font size="2"><i> <bean id="MistralAI"
parent="RelyingPartyByName" <b>c:relyingPartyIds="#{{'<a
class="moz-txt-link-freetext" href="https://sp.im.fr/sp"
moz-do-not-send="true">https://sp.im.fr/sp</a>'}}"</b>><br>
<br>
<property name="<b>activationCondition</b>"><br>
<bean parent="<b>shibboleth.Conditions.SimpleAttribute</b>"><br>
<property name="attributeValueMap"><br>
<map><br>
<entry key="<b>eduPersonPrimaryAffiliation</b>"><br>
<list><br>
<value><b>staff</b></value> </i></font></p>
<p><font size="2"><i>
<value>employee</value></i></font></p>
<p><font size="2"><i> </list><br>
</entry><br>
</map><br>
</property><br>
</bean><br>
</property> <br>
<br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"<br>
p:encryptAssertions="false"<br>
p:checkAddress="false" /><br>
</list><br>
</property><br>
<br>
</bean></i><br>
</font><br>
</p>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
<pre class="moz-signature" cols="72">--
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik Fax: +46 (0)980 79 050
Swedish Institute of Space Physics email: <a class="moz-txt-link-abbreviated" href="mailto:matsl@irf.se">matsl@irf.se</a>
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: <a class="moz-txt-link-freetext" href="https://www.irf.se/pgp/matsl">https://www.irf.se/pgp/matsl</a>
Digital vcard: <a class="moz-txt-link-freetext" href="https://www.irf.se/vcard/mats.luspa">https://www.irf.se/vcard/mats.luspa</a></pre>
</body>
</html>