PolicyRequirementRule attribute "valve"

[Tom Poage]

To close the loop on this (BTW, IdP 2.4):

1. No AttributeRule is needed for an attribute used as a
conditional-only switch (makes sense).

2. This works per the original use case (release-on-existence):

> <afp:PolicyRequirementRule xsi:type="basic:AND">
>     <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://foo.bar.edu/sp" />
>     <basic:Rule xsi:type="basic:NumberOfAttributes" attributeID="myAttribute" minimum="1" />
> </afp:PolicyRequirementRule>

3. Playing around a bit more and inverting the logic to effect a
deny-release-on-existence, this throws an error.

> <afp:PolicyRequirementRule xsi:type="basic:AND">
>     <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://foo.bar.edu/sp" />
>     <basic:Rule xsi:type="basic:NumberOfAttributes" attributeID="myAttribute" maximum="0" />
> </afp:PolicyRequirementRule>

Error:

> 13:48:59.053 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:158] - Loading new configuration for service shibboleth.AttributeFilterEngine
> 13:48:59.130 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.AttributeFilterEngine service, error creating components.  The root cause of this error was: org.xml.sax.SAXParseException: cvc-minInclusive-valid: Value '0' is not facet-valid with respect to minInclusive '1' for type 'positiveInteger'.
> 13:48:59.132 - ERROR [edu.internet2.middleware.shibboleth.common.config.BaseReloadableService:197] - Error reloading configuration, upon configuration resource update, for service shibboleth.AttributeFilterEngineedu.internet2.middleware.shibboleth.common.service.ServiceException: Configuration was not loaded for shibboleth.AttributeFilterEngine service, error creating components.

4. But, flipping limits and wrapping in a basic:NOT, does work as a
deny-release-on-existence:

> <afp:PolicyRequirementRule xsi:type="basic:AND">
>     <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://foo.bar.edu/sp" />
>     <basic:Rule xsi:type="basic:NOT">
>         <basic:Rule xsi:type="basic:NumberOfAttributeValues" attributeID="myAttribute" minimum="1" />
>     </basic:Rule>
> </afp:PolicyRequirementRule>

Lots of choices. Thanks for the input/feedback.

Tom.