Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »

Allows the IIS to perform roles based AuthZ

Require REMOTE_USER

The way in which Roles base Authentication works in IIS means that a valid REMOTE_USER must be specified. This allows the plugin to provide a Principal which can be interrogated for roles.

Attributes

NameTypeDefaultDescription
authNRolestringShibbolethAuthNAny principal which is logged in via the Shibboleth SP is given this role.
roleAttributesspace separated stringnoneAll values of all provided attributes with the names given are added to the Roles associated with this principal

Child Elements

No Child Elements may be specified

Example

Roles based AuthZ
<ISAPI normalizeRequest="true" safeHeaderNames="true">
    <Roles roleAttributes="ePa ePsa" />
</ISAPI>

Every SP-authenticated principal will be given the role ShibbolethAuthN.  Additionally the attributes 'ePa' and 'ePsa' will be queried and their values used as roles.  Hence if a user logged in via the SP and the following attributes were provided

  • eppn :  "User"
  • ePa : "member", "walkin"
  • epSa: "staff@example.org", "member@example.org"

The session would be have the REMOTE_USER variable set to be "User" (assuming that the default setting for ApplicationDefault> were used. and the following roles

  • ShibbolethAuthN  (by Virtue of being "logged in")

  • member

  • walkin

  • staff@example.org

  • member@example.org

  • No labels