NOT release rule to set of SPs

[Qian, Yi]

<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">

		<afp:PolicyRequirementRule xsi:type="basic:NOT">
			<basic:Rule xsi:type="basic:OR">
				<basic:Rule xsi:type="basic:AttributeRequesterString"
					value="sandbox 1 sp entity id" />
				<basic:Rule xsi:type="basic:AttributeRequesterString"
					value="sandbox 2 sp entity id" />
			</basic:Rule>
		</afp:PolicyRequirementRule>

		<afp:AttributeRule attributeID="TransientId">
			<afp:PermitValueRule xsi:type="basic:ANY" />
		</afp:AttributeRule>

	</afp:AttributeFilterPolicy>



On 7/12/13 12:11 PM, "David Bantz" <dabantz at alaska.edu> wrote:

>Please post the working attribute filter policy.
>Thanks,
>
>David Bantz
>U Alaska
>
>On Fri, 12 Jul 2013, at 07:07 , "Qian, Yi" <yqian at ku.edu> wrote:
>
>> Thanks Nate and Peter, wrap rule did the trick
>> 
>> On 7/12/13 3:18 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
>> 
>>> * Peter Schober <peter.schober at univie.ac.at> [2013-07-12 09:40]:
>>>> * Qian, Yi <yqian at ku.edu> [2013-07-12 05:56]:
>>>>> I tried several different ways, (with AND, NOT for every SP), none
>>>>> of them works. Apparently my google skill is not good either, the
>>>>> results of google did not really help
>>>> 
>>>> The documentation states that NOT can only contain one Rule element:
>>>> 
>>>> 
>>>>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequireme
>>>>nt
>>>> NOT
>>>> 
>>>> Directly combining several basic:AttributeRequesterString type rules
>>>> with AND will never match as there will only ever be one requestor in
>>>> the authN request.
>>> 
>>> I misunderstood your description above, sorry. Anyway having SPs
>>> combined with OR and wrapped in a final NOT seems much simpler.
>>> 
>>> If you think there's a bug with certain boolean constructs feel free
>>> to provide examples in the issue tracker for the devs to follow up.
>>> -peter
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>> 
>> 
>> 
>> --
>> To unsubscribe from this list send an email to
>>users-unsubscribe at shibboleth.net
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net
>