Re: shibuser.txt: expressions: Index(str, substr)

Stephen, you're right.  I failed to add auth: in my listserv message, but I
certainly have used the correct syntax in my real-world testing.

Examples:

If Any(auth:memberof, "library-allow-access") = 0;Deny
If AnyRE(auth:memberof, "/library-allow-access/gmi") = 0;Deny
If Index(auth:memberof, "library-allow-access") = -1;Deny
If AllWild(auth:memberof, "library-allow-access") = 0;Deny

Thank you!

Brad

On Fri, Oct 18, 2019 at 8:45 AM Stephen Graham <[email protected]>
wrote:

> Brad - do you need to prefix the attribute you are checking with the
> string "auth:". E.g.
>
> If Index(auth:memberof, library-allow-access) = -1; deny
>
> Looking at our shibuser.txt we have this type if syntax:
>
> If All(auth:memberStatus,"Staff") {
>         # do something
> }
>
> I can't recall now why auth was needed, or how we found out it was
> necessary, but it's worth a try?
>
> All the examples for shibuser.txt show the auth prefix:
>
>
> https://help.oclc.org/Library_Management/EZproxy/Authenticate_users/EZproxy_authentication_methods/SAML_authentication
>
> Stephen
>
> -----Original Message-----
> From: EZproxy List <[email protected]> On Behalf Of Brad Spry
> Sent: 18 October 2019 13:2en
> To: [email protected]
> Subject: [EZPROXY-L] shibuser.txt: expressions: Index(str, substr)
>
> My goal: DENY access to user when shibboleth attribute "memberof" does not
> contain string.
>
> Attribute details:
>
> name: urn:oid:1.3.6.1.4.1.5923.1.5.1.1
> friendly name: memberof
>
> value:CN=library-allow-access,OU=AppGroups,OU=IDM-Managed,OU=University-Access,DC=its,DC=uncc,DC=edu
>
> Expression documentation:
>
> https://help.oclc.org/Library_Management/EZproxy/Authenticate_users/Directives_and_configurations_for_authentication/Expressions#Functions
>
> I contend Index() is the most appropriate function:
>
> ---
> Index(str, substr)     This numeric function check to see if substr is
> contained with str.
> Returns -1 if substr is not contained within str, or returns the position
> where substr begins based from 0 (e.g., Index("abc", "d") returns -1,
> Index("abc", "a") return 0, Index("abc", "c") return 2).
> ---
> aggvar
> The base name of a variable that can have one or more value, such as the
> base name of an array or the name of an auth: variable that returns
> multiple values; when used with an aggregate test, EZproxy will also
> include any non-array variable of the specified name in the test (e.g.,
> abc, abc[1], and abc["xyz"] are all considered when performing an aggregate
> test for the variable abc).
> ---
>
> It should be as simple as:
> If Index(memberof, library-allow-access) = -1; deny
>
> I've tried this and lots of other functions and methods to no avail...  I
> do have other fully working expressions in shibuser.txt, ex: escalate uid
> to admin, uid deny, etc.
>
> OCLC has not been able to solve this for me.  I am hoping someone has some
> insight.  Thank you ahead of time.
>
> Brad Spry
> Atkins Library
> UNC Charlotte
>
> ********************************************************************
> If you wish to stop receiving messages from EZPROXY-L or otherwise amend
> your preferences, you can do so <a href="
> https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
> Or email [email protected] including the relevant text below in the
> body of the email:
> • To unsubscribe: "unsubscribe EZPROXY-L"
> • To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
> • To set your options to no mail: "set EZPROXY-L nomail"
> • To receive these messages in the future "set EZPROXY-L mail"
> To contact the list owners directly please send your message to
> [email protected].
> If you unsubscribe from EZPROXY-L, you will no longer be able to
> participate in any of its features, including the public forum.
> To unsubscribe from all OCLC marketing email communications (including all
> OCLC listervs, OCLC Connect emails, OCLC event notifications,
> product/service/cooperative updates and newsletters), please email us at
> [email protected].
>


********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].