Filters and Rules

[Peter Schober]

* Richard Genthner <moose at symplicity.com> [2014-07-21 16:01]:
> |Found the following attribute: businessCategory[splunk, jabber, mail, share, devwiki, saleswiki, supportwiki, fuse]
> 
> I want to limit access to that SP only to people that have the
> businessCategory that is say fuse. How would I go about doing in
> that ?

You usually are not in a position to limit access to an SP at the IDP,
you only get to decide what attributes to send to the SP for each case
you're prepared to handle. The details of that are not obvious to me,
from the above.

Did you look at the documentation? You don't mention it so here goes:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter#IdPAddAttributeFilter-MatchingRules

If you have a multi-valued attribute called "businessCategory" you
could check for a given value with the basic:AttributeValueString type
Rule in afp:PolicyRequirementRule, i.e., make the existence of a given
attribute with (at least) one of the given values a condition to
release something/anything to that SP:

<afp:AttributeFilterPolicy id="fo">
    <afp:PolicyRequirementRule xsi:type="basic:AND">
        <basic:Rule xsi:type="basic:AttributeRequesterString" alue="https://some.example.org/shibboleth" />
        <basic:Rule xsi:type="basic:AttributeValueString" attributeID="businessCategory" value="fuse" />
    </afp:PolicyRequirementRule>

    <!--
        Release any attributes you want here, including limiting their
	values, if needed
    -->
</afp:AttributeFilterPolicy>

If "businessCategory" does not in fact have multiple values but a
single string value with the "values" all mashed into one string
(first ask yourself why you're doing that?) you could use an
basic:AttributeValueRegex type Rule instead, and try to match the
content you want with regexes.

You can OR together several SPs in the same policy, of course, or
throw in AND'ed NOT rules, or whatever you need.
-peter