FERPA question

[Nickles, Brent]

Hello, I'm trying to test the following scenario:  Suppress attributes being released to SP's based on our Ferpa Flag, except I want to release them to SP's that I have specially requested them to be released to.   I have the following, but the denyonBuckley always seems to take precedence.   Any ideas on how to resolve?  Thanks in advance.

<AttributeFilterPolicy>
               <PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="anyspecific/sp" />
        <AttributeRule attributeID="sn">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>


----------
<AttributeFilterPolicy id="denyOnBuckley">

    <!-- Policy requirement rule that indicates this policy is active if FERPA s
uppression is enabled. -->
    <PolicyRequirementRule xsi:type="basic:AttributeValueString"
                           attributeID="umbBuckley"
                           value="Y" />

    <!-- Attribute rule for the surname attribute -->
    <AttributeRule attributeID="sn">
        <!-- Deny value rule that denies the release of any value. -->
        <DenyValueRule xsi:type="basic:ANY" />
    </AttributeRule>

</AttributeFilterPolicy>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121026/b5da35c3/attachment-0001.html