PolicyRequirementRule attribute "valve"

[Tom Poage]

On Sep 11, 2013, at 11:26 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> On 9/11/13 5:32 PM, "Tom Poage" <tfpoage at ucdavis.edu> wrote:
>> 
>> The following does not work, though I expect it would ("." being a valid
>> regex), unless there's an implicit anchor (various wiki examples show
>> explicit regex anchoring, e.g.
>> https://wiki.shibboleth.net/confluence/x/EoFC)
> 
> Doesn't appear to be anything implicit in the code. I don't know why it
> wouldn't work.

Occurred to me I introduced my own bug: ".*" is 0+ characters, rather than 1+ characters (cf. unanchored regex "."). Further, if the code considers null/empty set and an empty string as +/- equivalent, ".*" becomes an effective no-op (alway true).

Wondering now if an attribute tested in PolicyRequirementRule must also have an AttributeRule in the policy:

    <afp:AttributeFilterPolicy id="foo">

        <afp:PolicyRequirementRule xsi:type="basic:AND">
            <basic:Rule xsi:type="basic:AttributeValueRegex" attributeID="MyAttribute" regex="." />
        </afp:PolicyRequirementRule>

        <afp:AttributeRule attributeID="AttributeA">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="AttributeB">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
        <afp:AttributeRule attributeID="MyAttribute">
            <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>

I didn't try that earlier. Was hoping to use "MyAttribute" only as a conditional, not release it.

More testing needed. Might need to turn to the resolver.


>> Is there a usable attribute-exists (and I don't care what the value is)
>> type of test that can be performed here (other than the regex)?
> 
> There's one based on the number of values that appears to not be
> documented. The schema type is basic:NumberOfAttributeValues and it has
> minimum and maximum attributes for setting the boundaries to check.

Good to know.

> I know Rod found a number of issues with the V2 filtering code so it may
> not be implemented or the configuration logic may have issues, but the
> function is in the code at least.

I'll give it a shot, modulo the open question on AttributeRule above.

Thanks.
Tom.