<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>Meghan,</div>
<div>If you need more complex role assignment rules than the base Shibboleth module provides, I wrote a (barebones) module for D6 to add conditional rules. It takes a set of regex rules and applies a role to the user only if all the rules match.</div>
<div><br>
</div>
<div>It's D6, but there might be some useful code/ideas there: <a href="http://source.engineering.osu.edu/project/shib_conditional_rules">http://source.engineering.osu.edu/project/shib_conditional_rules</a></div>
<div><a href="http://code.engineering.osu.edu/project/shib_conditional_rules.git">http://code.engineering.osu.edu/project/shib_conditional_rules.git</a> </div>
<div><br>
</div>
<div>-- Corey Hinshaw</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span><Frazer>, Meghan <<a href="mailto:frazer.11@osu.edu">frazer.11@osu.edu</a>><br>
<span style="font-weight:bold">Reply-To: </span>Drupal List <<a href="mailto:Drupal@lists.service.ohio-state.edu">Drupal@lists.service.ohio-state.edu</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, November 6, 2013 1:16 PM<br>
<span style="font-weight:bold">To: </span>Drupal List <<a href="mailto:Drupal@lists.service.ohio-state.edu">Drupal@lists.service.ohio-state.edu</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Drupal] Shib Attributes to Drupal Roles<br>
</div>
<div><br>
</div>
<div>
<div>
<div dir="ltr">
<div>
<div>
<div>Hi Michael,<br>
<br>
Thanks so much for replying. As I get further into this, I may give you guys a shout.<br>
<br>
However, I was just coming back to reply to my own message - turns out I was looking in the wrong place to verify, because I skimmed over this part of the shib auth module documentation:<br>
</div>
<div>
<h4><span class="" id="Dynamic_rules_.28default.29">Dynamic rules (default) </span>
</h4>
<p>Dynamic rules add roles to the user, but <b>do not save them to the user's profile</b>. This means that
</p>
<ul>
<li>the roles assigned by dynamic rules are <b>NOT displayed on the user page</b>, even though the permissions assigned to the role are in effect
</li></ul>
</div>
<br>
</div>
Once I checked actual ability to access something only for that role, instead of just looking at the user list for assigned roles, it does seem to be working.
<br>
<br>
</div>
Thanks again,<br>
Meghan<br>
<div><br>
<div><br>
</div>
</div>
</div>
<div class="gmail_extra"><br clear="all">
<div><span style="font-family: Helvetica, Arial, sans-serif; font-size: 12px; line-height: 18px; background-color: rgb(255, 255, 255); color: rgb(187, 0, 0); font-weight: bold; ">Meghan Frazer </span><br style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px">
<span style="color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; font-size: 12px; line-height: 18px; background-color: rgb(255, 255, 255); ">Digital Resources Curator</span><br style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px">
<strong style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px">The Ohio State University</strong><br style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px">
<span style="font-family: Helvetica, Arial, sans-serif; font-size: 12px; line-height: 18px; background-color: rgb(255, 255, 255); color: rgb(187, 0, 0); ">College of Engineering</span><span style="color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; font-size: 12px; line-height: 18px; background-color: rgb(255, 255, 255); "> Knowlton
School of Architecture</span><br style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px">
<span style="color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; font-size: 12px; line-height: 18px; background-color: rgb(255, 255, 255); ">275 W. Woodruff Ave., Columbus, OH 43210</span><br style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px">
<span style="color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; font-size: 12px; line-height: 18px; background-color: rgb(255, 255, 255); ">614.975.3242 Mobile / 614.247.6645 Office</span><br style="color:rgb(51,51,51);font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px">
<a href="mailto:frazer.11@osu.edu" style="font-family:Helvetica,Arial,sans-serif;font-size:12px;line-height:18px;background-color:rgb(255,255,255);margin-right:10px" target="_blank">frazer.11@osu.edu</a>
<div><br>
</div>
</div>
<br>
<br>
<div class="gmail_quote">On Wed, Nov 6, 2013 at 1:00 PM, Butsko, Michael <span dir="ltr">
<<a href="mailto:butsko.7@osu.edu" target="_blank">butsko.7@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi Meghan,<br>
<br>
Dustin and I in ASC could probably help you with this; we are using shib attributes to assign roles on D6 and D7. I wouldn’t mind troubleshooting off list and then sending out the results if we can help.<br>
<br>
--<br>
Michael Butsko<br>
Web Developer<br>
The Ohio State University<br>
College of Arts and Sciences Technology Services<br>
475 Mendenhall Laboratory, 125 S Oval Mall Columbus, OH 43210<br>
<a href="tel:614-247-2791" value="+16142472791">614-247-2791</a> Office<br>
<a href="mailto:butsko.7@osu.edu">butsko.7@osu.edu</a> <a href="http://asctech.osu.edu" target="_blank">
asctech.osu.edu</a><br>
<div>
<div class="h5"><br>
<br>
<br>
<br>
On Nov 6, 2013, at 12:50, Meghan Frazer <<a href="mailto:frazer.11@osu.edu">frazer.11@osu.edu</a>> wrote:<br>
<br>
> Is anyone using Shibboleth attributes such eduPersonScopedAffiliation or departmentNumber to assign roles to users as they log in to a Drupal site?<br>
><br>
> The current impetus for this is that we'd like to restrict a submission form to just students from Knowlton, but we've wanted to provide some tiered access for awhile. We currently just use the authenticated user role to handle everyone from OSU, logged
in via shib<br>
><br>
> It looks to me like I can add a rule in the Shibboleth authentication configuration, but my first pass at checking the attribute didn't work (I tried departmentNumber).<br>
><br>
> If someone would be willing to chat with me about syntax for this, it might save me some trial and error and I would really grateful.<br>
><br>
> Thanks,<br>
> Meghan<br>
><br>
> Meghan Frazer<br>
> Digital Resources Curator<br>
> The Ohio State University<br>
> College of Engineering Knowlton School of Architecture<br>
> 275 W. Woodruff Ave., Columbus, OH 43210<br>
> <a href="tel:614.975.3242" value="+16149753242">614.975.3242</a> Mobile / <a href="tel:614.247.6645" value="+16142476645">
614.247.6645</a> Office<br>
> <a href="mailto:frazer.11@osu.edu">frazer.11@osu.edu</a><br>
><br>
</div>
</div>
> _______________________________________________<br>
> Drupal mailing list<br>
> <a href="mailto:Drupal@lists.service.ohio-state.edu">Drupal@lists.service.ohio-state.edu</a><br>
> <a href="https://lists.service.ohio-state.edu/mailman/listinfo/drupal" target="_blank">
https://lists.service.ohio-state.edu/mailman/listinfo/drupal</a><br>
<br>
<br>
_______________________________________________<br>
Drupal mailing list<br>
<a href="mailto:Drupal@lists.service.ohio-state.edu">Drupal@lists.service.ohio-state.edu</a><br>
<a href="https://lists.service.ohio-state.edu/mailman/listinfo/drupal" target="_blank">https://lists.service.ohio-state.edu/mailman/listinfo/drupal</a><br>
</blockquote>
</div>
<br>
</div>
</div>
</div>
</span>
</body>
</html>