NOT release rule to set of SPs

[Qian, Yi]

Hello

I have a release rule to release transient ID to every SP and we are setting up several SP sandboxes, which requires not to release the transient ID

<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">

<afp:PolicyRequirementRule xsi:type="basic:NOT">

<basic:Rule xsi:type="basic:AttributeRequesterString"

value="sandbox 1 SP entity ID" />

<basic:Rule xsi:type="basic:AttributeRequesterString"

value="sandbox 2 SP entity ID" />

</afp:PolicyRequirementRule>


<afp:AttributeRule attributeID="TransientId">

<afp:PermitValueRule xsi:type="basic:ANY" />

</afp:AttributeRule>


</afp:AttributeFilterPolicy>


But it is not working, The IdP start up complains about the rule. If I leave only one SP in the basic rule, it works.


I tried several different ways, (with AND, NOT for every SP), none of them works. Apparently my google skill is not good either, the results of google did not really help


Yi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130712/cb32dcce/attachment.html