<div dir="ltr"><div dir="ltr"><div>I think the correct approach is to use a context-check interceptor (<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199509927/ContextCheckInterceptConfiguration</a>).</div><div><br></div><div>You need to first install the support with:<br><pre>bin/module.sh -e idp.intercept.ContextCheck</pre>Then, you need to modify <code>conf/relying-party.xml </code>enabling the post-authentication flow.</div><div></div><div><pre class="gmail-code gmail-xml"><span class="gmail-sc3"><span class="gmail-re1"><bean</span> <span class="gmail-re0">parent</span>=<span class="gmail-st0">"SAML2.SSO"</span> <span class="gmail-re0">p:postAuthenticationFlows</span>=<span class="gmail-st0">"#{{'context-check'}}"</span> <span class="gmail-re0">p:encryptAssertions</span>=<span class="gmail-st0">"false"</span> <span class="gmail-re2">/></span></span></pre>Finally, create a file <em>conf/intercept/context-check-intercept-config.xml </em>with the configuration. We use something liek the following:<pre class="gmail-code gmail-xml"><span class="gmail-sc-1"><!-- Bean for restricting access to the admin user. --></span>
<span class="gmail-sc3"><span class="gmail-re1"><bean</span> <span class="gmail-re0">id</span>=<span class="gmail-st0">"OnlyAdmin"</span> <span class="gmail-re0">parent</span>=<span class="gmail-st0">"shibboleth.Conditions.SimpleAttribute"</span> <span class="gmail-re0">p:useUnfilteredAttributes</span>=<span class="gmail-st0">"true"</span><span class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><property</span> <span class="gmail-re0">name</span>=<span class="gmail-st0">"attributeValueMap"</span><span class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><map<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><entry</span> <span class="gmail-re0">key</span>=<span class="gmail-st0">"uid"</span><span class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><list<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><value<span class="gmail-re2">></span></span></span>admin_uid<span class="gmail-sc3"><span class="gmail-re1"></value<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></list<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></entry<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></map<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></property<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></bean<span class="gmail-re2">></span></span></span>
<br><!-- Bean for restricting access to people with member affiliation. --><br><bean id="OnlyMembers" parent="shibboleth.Conditions.SimpleAttribute" p:useUnfilteredAttributes="true"><br> <property name="attributeValueMap"><br> <map><br> <entry key="eduPersonAffiliation"><br> <list><br> <value>member</value><br> </list><br> </entry><br> </map><br> </property><br></bean><br>
<span class="gmail-sc-1"><!-- Map associating each SP entity id to its access condition. --></span>
<span class="gmail-sc3"><span class="gmail-re1"><util:map</span> <span class="gmail-re0">id</span>=<span class="gmail-st0">"ConditionMap"</span><span class="gmail-re2">></span></span>
<entry key="sp_entity_id_1"><br> <ref bean="OnlyAdmin"/><br> </entry><br> <entry key="sp_entity_id_2"><br> <ref bean="OnlyMembers"/><br> </entry>
<span class="gmail-sc3"><span class="gmail-re1"></util:map<span class="gmail-re2">></span></span></span>
<span class="gmail-sc-1"><!-- Bean checking the access condition for each SP entity id --></span>
<span class="gmail-sc3"><span class="gmail-re1"><bean</span> <span class="gmail-re0">id</span>=<span class="gmail-st0">"shibboleth.context-check.Function"</span> <span class="gmail-re0">parent</span>=<span class="gmail-st0">"shibboleth.ContextFunctions.Scripted"</span> <span class="gmail-re0">factory-method</span>=<span class="gmail-st0">"inlineScript"</span></span>
<span class="gmail-sc3"> <span class="gmail-re0">c:outputType</span>=<span class="gmail-st0">"java.lang.String"</span> <span class="gmail-re0">p:customObject-ref</span>=<span class="gmail-st0">"ConditionMap"</span><span class="gmail-re2">></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><constructor-arg<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"><value<span class="gmail-re2">></span></span></span>
<span class="gmail-sc2"><![CDATA[</span>
<span class="gmail-sc2"> var event = "proceed";</span>
<span class="gmail-sc2"> var rpid = input.getSubcontext(</span>
<span class="gmail-sc2"> "net.shibboleth.profile.context.RelyingPartyContext").getRelyingPartyId();</span>
<span class="gmail-sc2"> var condition = custom.get(rpid);</span>
<span class="gmail-sc2"> if (condition != null && !condition.test(input)) {</span>
<span class="gmail-sc2"> event = "ContextCheckDenied";</span>
<span class="gmail-sc2"> }</span>
<span class="gmail-sc2"> event;</span>
<span class="gmail-sc2"> ]]></span>
<span class="gmail-sc3"><span class="gmail-re1"></value<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></constructor-arg<span class="gmail-re2">></span></span></span>
<span class="gmail-sc3"><span class="gmail-re1"></bean<span class="gmail-re2">></span></span></span></pre><br></div><div>Best regards,</div><div>--gianluca</div><div><br></div><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Dec 7, 2025 at 7:15 PM <a href="mailto:jehan.procaccia@tem-tsp.eu" target="_blank">jehan.procaccia@tem-tsp.eu</a> <<a href="mailto:jehan.procaccia@tem-tsp.eu" target="_blank">jehan.procaccia@tem-tsp.eu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<p>Hello</p>
<p>I want to deny access to a specific SP to users whose ldap
resolved attribute contains specific values and allow for other
values<br>
</p>
<p>in my case specific SP is entityID <i><a href="https://sp.im.fr/sp" target="_blank">https://sp.im.fr/sp</a></i>
and attribute is <i>eduPersonPrimaryAffiliation</i> which should
be = to "staff" or "employee" to be allowed access, if a value of
"student" is resolved (or others as affiliate,member ...) , access
to the SP should be denied .<br>
</p>
<p>So I have created a RelyingPartyOverrides in relaying-party.xml
with activationCondition based on the value of the attribute for
that specific relyingParty, the code is loaded (IDP starts well,
it took me a while with lots of errors ...) , now users can
connect , but also users with eduPersonPrimaryAffiliation that are
different from staff or employee in my case [1] :-( <br>
</p>
<p>I guess that my IdP (v5.1.6) does not deny access when my
relying-party activationCondition evaluates to false, and then it
might falls back to the default relying-party config with the
default SAML2 SSO profile which is not restricted !? <br>
</p>
<p>can you help me buiding an operational configuration that allow
access to that specific SP only for users whose <i>eduPersonPrimaryAffiliation
= staff or employee </i>? <br>
</p>
<p>is relying-party.xml the right place to do that, or
access-control.xml file should be involved ? <br>
</p>
<p>regard</p>
<p>jehan<br>
</p>
<p><i><font size="2"> <util:list id="<b>shibboleth.RelyingPartyOverrides</b>"><br>
</font></i></p>
<p><font size="2"><i> <bean id="MistralAI"
parent="RelyingPartyByName" <b>c:relyingPartyIds="#{{'<a href="https://sp.im.fr/sp" target="_blank">https://sp.im.fr/sp</a>'}}"</b>><br>
<br>
<property name="<b>activationCondition</b>"><br>
<bean parent="<b>shibboleth.Conditions.SimpleAttribute</b>"><br>
<property name="attributeValueMap"><br>
<map><br>
<entry key="<b>eduPersonPrimaryAffiliation</b>"><br>
<list><br>
<value><b>staff</b></value> </i></font></p>
<p><font size="2"><i>
<value>employee</value></i></font></p>
<p><font size="2"><i> </list><br>
</entry><br>
</map><br>
</property><br>
</bean><br>
</property> <br>
<br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"<br>
p:encryptAssertions="false"<br>
p:checkAddress="false" /><br>
</list><br>
</property><br>
<br>
</bean></i><br>
</font><br>
</p>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div>
</div>