Why is filter policy not active?

[Andrew Morgan]

On Tue, 11 Feb 2014, David Bantz wrote:

>
> Here’s the filter policy
>
> <AttributeFilterPolicy id="releaseToOrigami">
>   <PolicyRequirementRule xsi:type="basic:OR">
>                <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK" />
>                <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://live.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK" />
>        </PolicyRequirementRule>
>    <AttributeRule attributeID="bannerID">
>        <PermitValueRule xsi:type="basic:ANY" />
>    </AttributeRule>
>    <AttributeRule attributeID="displayname">
>         <PermitValueRule xsi:type="basic:ANY" />
>    </AttributeRule>
>    <AttributeRule attributeID="email">
>        <PermitValueRule xsi:type="basic:ANY" />
>    </AttributeRule>
> </AttributeFilterPolicy>
>
> the incoming authN request
>
> 11:19:32.828 - DEBUG [PROTOCOL_MESSAGE:113] -
> <?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK" Destination="https://idp.alaska.edu/idp/profile/SAML2/POST/SSO" ForceAuthn="false" ID="_4C0655ABBA69A0F151CBA60B2BF32CF4" IsPassive="false" IssueInstant="2014-02-11T20:19:38Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
>   <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://demo.origamirisk.com</saml:Issuer>
>   <samlp:NameIDPolicy AllowCreate="true"/>
> </samlp:AuthnRequest>

Isn't the entityID the value of Issuer in the SAML request?  I think you 
should use "https://demo.origamirisk.com" instead of 
"https://demo.origamirisk.com/Origami/SSO/SamlLogin?providerAccount=UofAK" 
in your AttributeRequesterString matching rule.

 	Andy