Support » Plugin: Shibboleth » custom complexe computation of ROLE from shibboleth attribute

  • Resolved olobry



    I’d like to compute a ROLE based on the attributes returned by shibboleth.
    This is not a simple mapping, this is a real computation (with many ifs/then) because the attributes on which the computation is done depends on which Idp as been used to log in (I’m using a Discovery Service) and this is very heterogeneous.
    So my question is: how to extend the plugin to do that. I saw the shibboleth_roles and shibboleth_user_role but I’m not sure they can help…
    Did anyone already done something similar ?

    Best regards


Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Contributor Jonathan Champ


    shibboleth_user_role would be the right hook if you have access to the values you need to check. The values will probably be available from shibboleth_getenv() in the same way it is used by the shibboleth_get_user_role() function:

    		$values = explode( ';', shibboleth_getenv( $role_header ) );
    		if ( in_array( $role_value, $values ) ) {

    Then you’d use add_filter() to attach your function and perform your many if/then checks, ultimately returning the final value after any overrides have been applied.

    Could this meet your needs?



    Hi Jonathan,

    I think it should be ok !

    Actually, I was not sure how to access the attributes’ values as there is no arguments to the hook function and I was not sure I could call the shibboleth_* functions from within the context of the hook function.
    So it seems ok, I’ll try that way and let you know.

    Thanks very much !


    Plugin Contributor Jonathan Champ


    Hi Olivier,

    shibboleth_getenv() is a helper function that tries to match the normal variable names to your environment. If you want to play it safe, you could conditionally define your own helper function or access the environment directly.

    For now, I’ll mark this as resolved, because it sounds like you have the tools you need at the moment. If that changes, please let us know.

    Thank you,


Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘custom complexe computation of ROLE from shibboleth attribute’ is closed to new replies.