More on Attribute Filtering.

[Rod Widdowson]

> > Did you skype ?
> >
> > I'm interested in the discussion, just catching up.
> 
> Just email, my follow up message seemed to clarify the major source of
> confusion about how the attributeID gets used.

I thought of a way of formalizing this last night which I'll share here for
the record and also to give Scott a chance to tell me I'm wrong.

1) As discussed in the wiki some instantiations of MatchFunctorType are
naturally more suitable to being used in an "AttributeFilterPolicy"
statement (I called these criteria) and have odd, but consistent meaning
inside a Permit or Deny Rule.  Example:

<PolicyRequirementRule xsi:type="basic:PrincipalNameString" value="jsmith"
/>  

is natural.

<AttributeRule attributeID="eduPersonAffiliation">
        <PermitValueRule xsi:type="basic:PrincipalNameString" value="jsmith"
/>
</AttributeRule> 

Is less "natural" but has a meaning defined as "if it's true, then all
values, otherwise no values".

2) Some instantiations of MatchFunctorType (the matchers) are naturally more
suitable to being used inside a permit of deny rule.  Example:

<AttributeRule attributeID="eduPersonAffiliation">
        <PermitValueRule xsi:type="basic:AttributeValueString"
value="faculty" ignoreCase="true"/>
</AttributeRule>

Is natural whereas

<PolicyRequirementRule xsi:type=="basic:AttributeValueString"
value="faculty" ignoreCase="true"/>

Is less natural but has a defined meaning (if any value of any attribute has
this value then true).

3) Instantiations of AttributeTargetted[Regexp|String]MatchType have an
optional attribute "attributeID" which changes the object from being a
"natural" matcher to being a "natural" criterion and so the behaviour
changes.  Example:

<PolicyRequirementRule xsi:type="basic:AttributeValueString"
attributeID="eduPersonAffiliation" value="faculty" ignoreCase="true"/>

 is "natural" and has "criterion" rules.

<AttributeRule attributeID="eduPersonPrincipalName">
        <PermitValueRule xsi:type="basic:AttributeValueString"
attributeID="eduPersonAffiliation"  value="faculty" ignoreCase="true"/>
</AttributeRule>

Is "unnatural" (and also has "criterion" rules).

4) My confusion came from the fact that "attributeID" is used in three
actually places (AttributeRuleType, AttributeTargettedRegexpMatchType,
AttributeTargettedStringMatchType).  For the user the meaning "is obvious",
but the semantics are completely different between the first and the second
two.  I was trying to ram the two different semantics into the same can and
failing.