Re: shibuser.txt: expressions: Index(str, substr)

Hi Brad – would something like the following work for you?

if (auth:memberof !~ "/ library-allow-access /");
Deny

Stephen

From: EZproxy List <[email protected]> On Behalf Of Brad Spry
Sent: 18 October 2019 13:49
To: [email protected]
Subject: Re: [EZPROXY-L] shibuser.txt: expressions: Index(str, substr)

Stephen, you're right.  I failed to add auth: in my listserv message, but I certainly have used the correct syntax in my real-world testing.

Examples:

If Any(auth:memberof, "library-allow-access") = 0;Deny
If AnyRE(auth:memberof, "/library-allow-access/gmi") = 0;Deny
If Index(auth:memberof, "library-allow-access") = -1;Deny
If AllWild(auth:memberof, "library-allow-access") = 0;Deny

Thank you!

Brad

On Fri, Oct 18, 2019 at 8:45 AM Stephen Graham <[email protected]<mailto:[email protected]>> wrote:
Brad - do you need to prefix the attribute you are checking with the string "auth:". E.g.

If Index(auth:memberof, library-allow-access) = -1; deny

Looking at our shibuser.txt we have this type if syntax:

If All(auth:memberStatus,"Staff") {
        # do something
}

I can't recall now why auth was needed, or how we found out it was necessary, but it's worth a try?

All the examples for shibuser.txt show the auth prefix:

https://help.oclc.org/Library_Management/EZproxy/Authenticate_users/EZproxy_authentication_methods/SAML_authentication

Stephen

-----Original Message-----
From: EZproxy List <[email protected]<mailto:[email protected]>> On Behalf Of Brad Spry
Sent: 18 October 2019 13:2en
To: [email protected]<mailto:[email protected]>
Subject: [EZPROXY-L] shibuser.txt: expressions: Index(str, substr)

My goal: DENY access to user when shibboleth attribute "memberof" does not contain string.

Attribute details:

name: urn:oid:1.3.6.1.4.1.5923.1.5.1.1
friendly name: memberof
value:CN=library-allow-access,OU=AppGroups,OU=IDM-Managed,OU=University-Access,DC=its,DC=uncc,DC=edu

Expression documentation:
https://help.oclc.org/Library_Management/EZproxy/Authenticate_users/Directives_and_configurations_for_authentication/Expressions#Functions

I contend Index() is the most appropriate function:

---
Index(str, substr)     This numeric function check to see if substr is contained with str.
Returns -1 if substr is not contained within str, or returns the position where substr begins based from 0 (e.g., Index("abc", "d") returns -1, Index("abc", "a") return 0, Index("abc", "c") return 2).
---
aggvar
The base name of a variable that can have one or more value, such as the base name of an array or the name of an auth: variable that returns multiple values; when used with an aggregate test, EZproxy will also include any non-array variable of the specified name in the test (e.g., abc, abc[1], and abc["xyz"] are all considered when performing an aggregate test for the variable abc).
---

It should be as simple as:
If Index(memberof, library-allow-access) = -1; deny

I've tried this and lots of other functions and methods to no avail...  I do have other fully working expressions in shibuser.txt, ex: escalate uid to admin, uid deny, etc.

OCLC has not been able to solve this for me.  I am hoping someone has some insight.  Thank you ahead of time.

Brad Spry
Atkins Library
UNC Charlotte

********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences, you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected]<mailto:[email protected]> including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected]<mailto:[email protected]>.
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications (including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters), please email us at [email protected]<mailto:[email protected]>.

________________________________

To unsubscribe from the EZPROXY-L list, click the following link:
http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1

********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].