Versions Compared

Old Version 106

changes.mady.by.user Hong Ye

Saved on

compared with

New Version 107

changes.mady.by.user Hong Ye

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleUpdate Access Control shib.conf

Open /etc/httpd/conf.d/shib.conf in a text editor. If you are Not using default Apache installation, make sure this file is included in your Apache config. All the authorization rules should be defined in this file.

Code Block
titleRequire authentication for entire site
<Location />
AuthType shibboleth
ShibRequestSetting requireSession 1
Require valid-user
</Location>


Code Block
titleAuthorization by affiliation
<Location /studentOnly>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr eduPersonPrimaryAffiliation student
</Location>

<Location /secure>
  AuthType shibboleth
  ShibRequestSetting requireSession 1
  Require shib-attr eduPersonAffiliations staff
</Location>

*eduPersonPrimaryAffiliation is single value attribute while eduPersonAffiliations is multi-values attribute. 
For example, a staff who also taking courses at Cornell has staff as the value of eduPersonPrimaryAffiliation, has staff and student as the value of eduPersonAffiliations. 
All the possible value of affiliations can be found at https://confluence.cornell.edu/display/IDM/edupersonprimaryaffiliation+and+edupersonaffiliation+details


Code Block
titleAuthorization by group/permit
<Location /secure>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shib-attr groups myGroup1 myGroup2
</Location> 

*Group Name is CASE SENSITIVE


Code Block
titleAuthorization by NetID
<Location /secure>
AuthType shibboleth
ShibRequestSetting requireSession 1
Require shib-attr uid hjy789 jpq2020
</Location> 


Code Block
titleRequire Two-Factor for Everyone
https://confluence.cornell.edu/display/SHIBBOLETH/Configure+Website+for+Two-Factor+Authentication+in+Apache


...