Attribute filtering problem with AND on both IdP and SP

[John Horne]

Hello,

For a particular SP (which we run; version 2.5.3) I am trying to ensure
that the eduPersonAffiliation attribute contains both 'member' and
'staff'. It can contain other things, but must have these two values.

In the IdP (version 2.4.1) attribute filter I configured:

===================
<afp:AttributeRule attributeID="eduPersonAffiliation">
  <afp:PermitValueRule xsi:type="basic:AND">
     <basic:Rule xsi:type="basic:AttributeValueString" value="staff"/>
     <basic:Rule xsi:type="basic:AttributeValueString" value="member"/>
  </afp:PermitValueRule>
</afp:AttributeRule>
===================

In the SP attribute policy I configured:

===================
<afp:AttributeRule attributeID="eduPersonAffiliation">
  <afp:PermitValueRule xsi:type="basic:AttributeValueRegex"
regex=".+" />
</afp:AttributeRule>
===================

However, the IdP produces no final attribute, and (obviously) the SP
sees nothing. Both the IdP and SP logs indicate this.

If I put the AND into the SP, and configure the IdP to release ANY value
for eduPersonAffiliation, then the IdP indicates the attribute has 2
values and releases them. The SP sees two values (the log shows that
they are 'staff' and 'member'), but removes them and so ends up with no
attribute again. 

If I change the AND to an OR (on the IdP or the SP), then it works fine.

I am somewhat lost with this. For some reason it seems that both the IdP
and the SP do not like the AND rule. Anyone any thoughts about this?



Thanks,

John.

-- 
----------------------------------------------------
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK