Page History

...

Expand

title	Update Access Control shib.conf

Open /etc/httpd/conf.d/shib.conf in a text editor. If you are Not using default Apache installation, make sure this file is included in your Apache config. All the authorization rules should be defined in this file.

Code Block

title	Require authentication for entire site

<Location />
AuthType shibboleth
ShibRequestSetting requireSession 1
Require valid-user
</Location>

Code Block

title	Example: Authorization by group/permit

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr groups myGroup1 myGroup2
</Location>

Code Block

title	Require TwoFactor for everyone

<Location /superSecret>
  AuthType shibboleth
  ShibRequestSetting authnContextClassRef http://cornell.edu/mfa
  ShibRequestSetting requireSession 1
  Require shib-attr groups mySecureGroup
</Location>

Code Block

title	Authorization by affiliation

<Location /studentOnly>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr eduPersonPrimaryAffiliation student
</Location>

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr eduPersonAffiliations staff
</Location>

eduPersonAffiliations is multi-values attribute. For example, user can be staff and alum. All the possible value of affiliations can be found at https://confluence.cornell.edu/display/IDM/edupersonprimaryaffiliation+and+edupersonaffiliation+details

Register Service Provider with Cornell IDP

...

Child pages

Versions Compared

Old Version 16

New Version 17

Key

Register Service Provider with Cornell IDP