Shibboleth Conditional Rules

This module extends the Shibboleth authentication module by adding 'conditional rules' that allow the administrator to dynamically assign roles based on Shibboleth attributes. This is similar to the existing shib_auth rules but with the ability to add multiple conditions to each rule. Each condition is evaluated separately using its own regex against its own Shibboleth attribute. If all conditions associated with a rule match, then the rule applies the defined roles to the user.

This allows scenarios like: "Give all Shibboleth authenticated users with a department ID from 100 to 150 who also have an employment status of 'part-time' the 'part time production' role."

Originally developed for the Ohio State University College of Engineering.

Dependencies

• Shibboleth authentication