attribute-resolver.xml attribute with different data for each service ?!

[Rui Ramos]

Thanks on quick reply Chad,

  Yes, that's exactly the case i have a bunch of entitlements defined 
  and i want to release only the ones for that service.

ex:
urn:mace:terena.org:tcs:escience-admin
urn:mace:terena.org:tcs:personal-admin
urn:mace:terena.org:tcs:escience-admin
urn:mace:terena.org:tcs:personal-admin
...

So i set the following policy for the tcs service:

   <PermitValueRule xsi:type="basic:OR">
                      <basic:Rule xsi:type="basic:AttributeValueString"
value="urn:mace:terena.org:tcs:escience-admin" ignoreCase="true"/>
                      <basic:Rule xsi:type="basic:AttributeValueString"
value="urn:mace:terena.org:tcs:personal-admin" ignoreCase="true"/>
                      <basic:Rule xsi:type="basic:AttributeValueString"
value="urn:mace:terena.org:tcs:escience-user" ignoreCase="true"/>
                      <basic:Rule xsi:type="basic:AttributeValueString"
value="urn:mace:terena.org:tcs:personal-user" ignoreCase="true"/>
                   </PermitValueRule>


Restarted the service and worked like a charm ;)

Thanks, Rui


On Mon, 2011-12-26 at 09:53 -0500, Chad La Joie wrote:
> Yes, but first I think your underlying assumption is wrong.  Normally a
> persons entitlements wouldn't change just because of the service they
> are accessing.  That is to say, I don't get a new entitlement just
> because I logged in from service A.  Instead, what normally changes is
> which of the user's entitlement values you want to send to a service.
> 
> So, *if* you really mean that a person is granted new entitlements based
> on the service they are logging in from, then you'd want to use the
> scripted attribute definition or write your own.
> 
> If, however, you mean the more normal case of only wanting to release
> certain entitlements to certain services then you'd do that in the
> attribute filter engine.  You'd create a policy for the service, then an
> attribute value rule that only allows particular entitlements values to
> be released.
> 
> 
> On 12/26/11 9:46 AM, Rui Ramos wrote:
> > Hello *,
> > 
> > I'm having some issues setting one attribute of type script in my IDP
> > resolver config.
> > 
> > The main ideia was to have eduPersonEntitlement filled differently
> > according to the service
> > that initiated the auth request.
> > 
> >   Does the IDP suports this ? 
> > 
> > Best Regards,
> > Rui Ramos
> > 
> > 
> > -- 
> > :: Rui Ramos ::
> > Universidade do Porto - Reitoria
> > Administração de Sistemas e Computação
> > 
> > T: +351 220408164
> > E: rramos at reit.up.pt <mailto:rramos at reit.up.pt>
> > 
> > 
> > 
> > --
> > To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

-- 
:: Rui Ramos ::
Universidade do Porto - Reitoria
Administração de Sistemas e Computação

T: +351 220408164
E: rramos at reit.up.pt