More on Attribute Filtering.

[Cantor, Scott]

> I thought of a way of formalizing this last night which I'll share here for
> the record and also to give Scott a chance to tell me I'm wrong.

That's a pretty good summary.

> <AttributeRule attributeID="eduPersonAffiliation">
>         <PermitValueRule xsi:type="basic:PrincipalNameString" value="jsmith"
> />
> </AttributeRule>
> 
> Is less "natural" but has a meaning defined as "if it's true, then all
> values, otherwise no values".

One nit, I would term that "this value, otherwise not this value". Permit/Deny rules operate on individual values, one at a time, not the whole set. This can be confusing, and also has implications for efficiency.

We could of course try and change that particular aspect of the interface, but it's awkward, since many of the rules would filter out most values and then another would put them back, but maybe it would work.

-- Scott