FERPA question

[Etan Weintraub]

I may be wrong, but I think you need to invert your requirements.

i.e. Have the test for your value be on the allow, instead of on the deny.

Logically, right now you have it set up as:

Release sn
If (umbBuckley eq "Y") { Don't release sn }

I think you need to make it:

Don't release sn
If (umbBuckley ne "Y") { Release sn }

-Etan E. Weintraub
Sr. Systems Engineer
Directory Architecture
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Suite 3110B
Baltimore, MD 21209
Phone: 410-735-7945
E-mail: eweintra at jhmi.edu<mailto:eweintra at jhmi.edu>

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nickles, Brent
Sent: Friday, October 26, 2012 11:02 AM
To: users at shibboleth.net
Subject: FERPA question

Hello, I'm trying to test the following scenario:  Suppress attributes being released to SP's based on our Ferpa Flag, except I want to release them to SP's that I have specially requested them to be released to.   I have the following, but the denyonBuckley always seems to take precedence.   Any ideas on how to resolve?  Thanks in advance.

<AttributeFilterPolicy>
               <PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
value="anyspecific/sp" />
        <AttributeRule attributeID="sn">
            <PermitValueRule xsi:type="basic:ANY" />
        </AttributeRule>
    </AttributeFilterPolicy>


----------
<AttributeFilterPolicy id="denyOnBuckley">

    <!-- Policy requirement rule that indicates this policy is active if FERPA s
uppression is enabled. -->
    <PolicyRequirementRule xsi:type="basic:AttributeValueString"
                           attributeID="umbBuckley"
                           value="Y" />

    <!-- Attribute rule for the surname attribute -->
    <AttributeRule attributeID="sn">
        <!-- Deny value rule that denies the release of any value. -->
        <DenyValueRule xsi:type="basic:ANY" />
    </AttributeRule>

</AttributeFilterPolicy>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121026/fd5f1782/attachment.html