...
CUWebAuth | Shibboleth(shib.conf) | Shibboleth(shibboleth2.xml) |
---|---|---|
AuthType all | AuthType shibboleth ShibRequestSetting requireSession 1 | |
Require valid-user | Require valid-user | |
Require netid netid1 netid2 | Require shib-attr uid netid1 netid2 | |
Require permit myPermit | Require shib-attr groups myPermit | |
Require noprompt | Not supported | |
CUWA2FARequire all |
ShibRequestSetting authnContextClassRef https: //refeds.org/profile/mfa <RequireAll> Require shib-attr groups mySecureGroup </RequireAll> Apache 2.2 Unfortunately Apache 2.2 does not support the <RequireAll> block and interprets multiple Require directives with an implicit 'OR' . Shibboleth SP instead provides an equivalent functionality to RequireAll. ShibRequestSetting authnContextClassRef https: //refeds.org/profile/mfa ShibRequireAll on ShibCompatWith24 on Require shib-attr groups mySecureGroup Require authnContextClassRef "https://refeds.org/profile/mfa" | |
CUWA2FARequire permit-name1 permit-name2 | Not supported in Shibboleth SP. But can be supported in Shibboleth IDP. Please specify your requirement in shibboleth integration request form | |
CUWACredentialAge | <Sessions lifetime= ... > | |
CUWAinactivityTimeout | <Sessions ... timeout=...> | |
Combination of CUWACredentialAge and CUWAinactivityTimeout for the purpose of forcing user re-login |
| |
CUWAwak2Name CUWAwaK0Realms | If your site supports GuestID login, there is no special configuration needed on your end. You just need to indicate that in Shibboleth integration request form. If your site supports Weill Medicine CWID login, please read: |
...