More on Attribute Filtering.

[Cantor, Scott]

On 3/18/13 8:03 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:

>In (for instance) the documentation for AttributeValueString
>(https://wiki.shibboleth.net/confluence/x/IIFC) it states that attributeID
>is associated the AttributeValueString rule, whereas in fact (in the
>schema)
>is it associated with the PolicyRequirementRule.  As such, providing an
>attributeID in a PermitRule or a DenyRule is non schema-valid (as well as
>being meaningless).

I think you're missing an additional layer. attributeID is on either
AttributeRule or PolicyRequirementRule, or specific Permit/Deny rules of
particular functor types. It associates not with the PolicyRequirementRule
element, but with the match functor type within that element. In the case
of AttributeRule, it's bound explicitly to the AttributeRule. Then it
shows up again within specific permit/deny elements based, again, on the
functor type.

I have a lot more I can say, but we should get on Skype and do this, it's
too hard to cover in an email.

-- Scott