PolicyRequirementRule attribute "valve"

Tom Poage tfpoage at ucdavis.edu
Wed Sep 11 17:32:28 EDT 2013


Looking for how one might perform a test on the existence of an
attribute within a PolicyRequirementRule, i.e. the existence (or lack)
the attribute effectively a valve on attribute release.

The following does not work, though I expect it would ("." being a valid
regex), unless there's an implicit anchor (various wiki examples show
explicit regex anchoring, e.g.
https://wiki.shibboleth.net/confluence/x/EoFC)

> <afp:PolicyRequirementRule xsi:type="basic:AND">
>     <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://foo.bar.edu/sp" />
>     <basic:Rule xsi:type="basic:AttributeValueRegex" attributeID="myAttribute" regex="." />
> </afp:PolicyRequirementRule>

This works as intended (".*"):

> <afp:PolicyRequirementRule xsi:type="basic:AND">
>     <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://foo.bar.edu/sp" />
>     <basic:Rule xsi:type="basic:AttributeValueRegex" attributeID="myAttribute" regex=".*" />
> </afp:PolicyRequirementRule>

Is there a usable attribute-exists (and I don't care what the value is)
type of test that can be performed here (other than the regex)?

I don't mind using the regex, but did find its "." behavior confusing.

Thanks!
Tom.


More information about the users mailing list