diff --git a/modules/authorize/default-enable b/modules/authorize/default-enable
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/modules/authorize/dictionaries/Authorize.php b/modules/authorize/dictionaries/Authorize.php
new file mode 100644
index 0000000000000000000000000000000000000000..4e3fc58a5be9964f71375c685eddffcca95125ed
--- /dev/null
+++ b/modules/authorize/dictionaries/Authorize.php
@@ -0,0 +1,15 @@
+<?php
+
+$lang = array(
+ '403_header' => array (
+ 'en' => 'Access forbidden',
+ 'es' => 'Acceso denegado',
+ ),
+ '403_text' => array (
+ 'en' => "You don't have the needed privileges to access this application. Please contact the administrator if you find this to be incorrect.",
+ 'es' => "No tiene los privilegios necesarios para acceder a esta aplicaciĂłn. Si considera que esto no es correcto, consulte el administrador.",
+ ),
+);
+
+
+?>
diff --git a/modules/authorize/docs/authorize.txt b/modules/authorize/docs/authorize.txt
new file mode 100644
index 0000000000000000000000000000000000000000..69210616b838c1fac9ca96b46bea1c183248ad6e
--- /dev/null
+++ b/modules/authorize/docs/authorize.txt
@@ -0,0 +1,53 @@
+authorize Module
+================
+
+<!--
+ This file is written in Markdown syntax.
+ For more information about how to use the Markdown syntax, read here:
+ http://daringfireball.net/projects/markdown/syntax
+-->
+
+ * Version: `$Id$`
+ * Author: Ernesto Revilla <erny@yaco.es>, Yaco Sistemas
+ * Package simpleSAMLphp
+
+
+This module provides an user authorization filter based on regular
+expressions for those applications that do not cleanly separate
+authentication from authorization and set some default permissions
+for authenticated users.
+
+
+`authorize:Authorize`
+: Authorize certain users based on regular expressions.
+
+
+`authorize:Authorize`
+---------------------
+
+For each attribute you can specify a regular expression
+string or array of strings. If one of those attributes matches (OR operator)
+one of the regular expression, the user is authorized successfully.
+
+You must use the preg_match format, i.e. you have to enclose it with
+a delimiter that does not appear inside the regex
+(e.g. slash (/), at sign (@), number sign (#) or underscore (_)).
+
+The users not authorized will be shown a 403 Forbidden page.
+
+Problems:
+ * Once you get the forbidden page, you can't logout at the IdP directly,
+ (as far as I know), you have to close the browser.
+
+
+To use this filter configure it in `config/config.php`:
+ 'authproc.sp' => array(
+ 60 => array(
+ 'class' => 'authorize:Authorize',
+ 'uid' => array(
+ '/.*@example.com/',
+ '/(user1|user2|user3)@example.edu/',
+ ),
+ 'schacUserStatus' => '@urn:mace:terena.org:userStatus:' .
+ 'example.org:service:active.*@',
+ )
diff --git a/modules/authorize/lib/Auth/Process/Authorize.php b/modules/authorize/lib/Auth/Process/Authorize.php
new file mode 100644
index 0000000000000000000000000000000000000000..baf94e83fc0e1665785c455018a8cce6b4df9f86
--- /dev/null
+++ b/modules/authorize/lib/Auth/Process/Authorize.php
@@ -0,0 +1,86 @@
+<?php
+
+/**
+ * Filter to authorize only certain users.
+ * See docs directory.
+ *
+ * @author Ernesto Revilla, Yaco Sistemas SL.
+ * @package simpleSAMLphp
+ * @version $Id$
+ */
+class sspmod_authorize_Auth_Process_Authorize extends SimpleSAML_Auth_ProcessingFilter {
+
+ /**
+ * Array of valid users. Each element is a regular expression. You should
+ * user \ to escape special chars, like '.' etc.
+ *
+ */
+ private $valid_attribute_values = array();
+
+
+ /**
+ * Initialize this filter.
+ * Validate configuration parameters.
+ *
+ * @param array $config Configuration information about this filter.
+ * @param mixed $reserved For future use.
+ */
+ public function __construct($config, $reserved) {
+ parent::__construct($config, $reserved);
+
+ assert('is_array($config)');
+
+ foreach ($config as $attribute => $values) {
+ if (is_string($values))
+ $values = array($values);
+ if (!is_array($values))
+ throw new Exception('Filter Authorize: Attribute values is neither string nor array: ' . var_export($attribute, TRUE));
+ foreach ($values as $value){
+ if(!is_string($value)) {
+ throw new Exception('Filter Authorize: Each value should be a string for attribute: ' . var_export($attribute, TRUE) . ' value: ' . var_export($value, TRUE) . ' Config is: ' . var_export($config, TRUE));
+ }
+ }
+ $this->valid_attribute_values[$attribute] = $values;
+ }
+ }
+
+
+ /**
+ * Apply filter to validate attributes.
+ *
+ * @param array &$request The current request
+ */
+ public function process(&$request) {
+ $authorize = FALSE;
+ assert('is_array($request)');
+ assert('array_key_exists("Attributes", $request)');
+
+ $attributes =& $request['Attributes'];
+
+ foreach ($this->valid_attribute_values as $name => $patterns) {
+ if(array_key_exists($name, $attributes)) {
+ foreach ($patterns as $pattern){
+ $values = $attributes[$name];
+ if (!is_array($values))
+ $values = array($values);
+ foreach ($values as $value){
+ if(preg_match($pattern, $value)) {
+ $authorize = TRUE;
+ break 3;
+ }
+ }
+ }
+ }
+ }
+ if (!$authorize){
+ /* Save state and redirect to 403 page. */
+ $id = SimpleSAML_Auth_State::saveState($request,
+ 'authorize:Authorize');
+ $url = SimpleSAML_Module::getModuleURL(
+ 'authorize/authorize_403.php');
+ SimpleSAML_Utilities::redirect($url, array('StateId' => $id));
+ }
+ }
+}
+
+?>
diff --git a/modules/authorize/templates/authorize_403.php b/modules/authorize/templates/authorize_403.php
new file mode 100644
index 0000000000000000000000000000000000000000..6bb2e3b4f745550702a39c46ecb617e8d477fc03
--- /dev/null
+++ b/modules/authorize/templates/authorize_403.php
@@ -0,0 +1,23 @@
+<?php
+/**
+ * Template which is shown when there is only a short interval since the user was last authenticated.
+ *
+ * Parameters:
+ * - 'target': Target URL.
+ * - 'params': Parameters which should be included in the request.
+ *
+ * @package simpleSAMLphp
+ * @version $Id$
+ */
+
+
+$this->data['403_header'] = $this->t('{authorize:Authorize:403_header}');
+$this->data['403_text'] = $this->t('{authorize:Authorize:403_text}');
+
+$this->includeAtTemplateBase('includes/header.php');
+?>
+<h1><?php echo $this->data['403_header']; ?></h1>
+<p><?php echo $this->data['403_text']; ?></p>
+<?php
+$this->includeAtTemplateBase('includes/footer.php');
+?>
diff --git a/modules/authorize/www/authorize_403.php b/modules/authorize/www/authorize_403.php
new file mode 100644
index 0000000000000000000000000000000000000000..60e0d9b7c1427f785b25e9c401f6933adbd8f65c
--- /dev/null
+++ b/modules/authorize/www/authorize_403.php
@@ -0,0 +1,22 @@
+<?php
+/**
+ * Show a 403 Forbidden page about not authorized to access an application.
+ *
+ * @package simpleSAMLphp
+ * @version $Id$
+ */
+
+if (!array_key_exists('StateId', $_REQUEST)) {
+ throw new SimpleSAML_Error_BadRequest('Missing required StateId query parameter.');
+}
+
+$id = $_REQUEST['StateId'];
+$state = SimpleSAML_Auth_State::loadState($id, 'authorize:Authorize');
+
+$globalConfig = SimpleSAML_Configuration::getInstance();
+$t = new SimpleSAML_XHTML_Template($globalConfig, 'authorize:authorize_403.php');
+header('HTTP/1.0 403 Forbidden');
+$t->show();
+
+
+?>