Attribute Filter Rule question ?

[Robert Roll]

Should the following work ?

     <afp:AttributeRule attributeID="uuBOXprimaryEmail">
       <afp:PermitValueRule xsi:type="basic:OR">
          <basic:Rule xsi:type="basic:AttributeValueString" attributeID="eduPersonAffiliation" value="student" />
          <basic:Rule xsi:type="basic:AttributeValueString" attributeID="eduPersonAffiliation" value="staff" />
       </afp:PermitValueRule>
     </afp:AttributeRule>

After a little bit of experimentation, it actually seems that the attributeID="uuBOXprimaryEmail"
in AttributeRule is overriding the attributeID="eduPersonAffiliation" in the basic:Rule ?



I was able to accomplish what I needed with a totally new attribute filter policy (see below),
but it would be convenient to have them in the same policy ..

(yes, this is all part of Box wanting the IDP to do validation of the user) ...

Thanks,

Robert

<!-- Box Primary E-mail -->
<afp:AttributeFilterPolicy>
      <afp:PolicyRequirementRule xsi:type="basic:AND">
          <basic:Rule xsi:type="basic:AttributeRequesterString" value="https://services.box.com/sp" />
          <basic:Rule xsi:type="basic:OR">
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="eduPersonAffiliation" value="staff" ignoreCase="true" />
            <basic:Rule xsi:type="basic:AttributeValueString" attributeID="eduPersonAffiliation" value="student" ignoreCase="true" />
          </basic:Rule>
      </afp:PolicyRequirementRule>
 
      <afp:AttributeRule attributeID="uuBOXprimaryEmail">
          <afp:PermitValueRule xsi:type="basic:ANY" />
      </afp:AttributeRule>
 
</afp:AttributeFilterPolicy>