IdPFilterRequirementScript always returns true

[Sara Hopkins]

D'oh! How thick am I recently? (Please don't answer that!)

Yes, Peter, that's perfect. I now have basically what I want with this, which I've tested and does just what I want:

    <afp:AttributeFilterPolicy id="testSP">
        <afp:PolicyRequirementRule xsi:type="basic:AND">
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="groupID" value="someGroupID"/>
            <basic:Rule xsi:type="basic:AttributeRequesterString" value="someEntityID"/>
         </afp:PolicyRequirementRule>
         <afp:AttributeRule attributeID="eduPersonScopedAffiliation">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

Thanks all for your help.

Sara

On 29/02/2012 14:55, Peter Schober wrote:
> * Sara Hopkins<sara.hopkins at ed.ac.uk>  [2012-02-29 14:24]:
>> OK, thanks, so it's looking as if the example code is wrong
>> then. What I want to do is to check an LDAP attribute and use its
>> value to determine which attributes (if any) should be released to
>> the SP. The idea is to apply access restrictions at the IdP end to
>> particular sets of resources for particular groups of students. Am I
>> missing some better way of doing this, perhaps?
> 
> Well, in the general sense of the question there's a
> basic:AttributeValueString type rule, e.g.
> 
> <basic:Rule xsi:type="basic:AttributeValueString" attributeID="fooUniGroup" value="some:id:for:a:group" />
> 
> The the containing PolicyRequirementRule would become active if the
> attribute "fooUniGroup" had the value of "some:id:for:a:group".
> No scripting involved,
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

-- 
Sara Hopkins
Support Team
UK Access Management Federation for Education and Research
web:    http://www.ukfederation.org.uk/

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.