Attribute filtering problem with AND on both IdP and SP

[Cantor, Scott]

> For a particular SP (which we run; version 2.5.3) I am trying to ensure
> that the eduPersonAffiliation attribute contains both 'member' and
> 'staff'. It can contain other things, but must have these two values.

I think that would be an authz rule, not a filtering thing.

Must have those values in what sense?

> In the IdP (version 2.4.1) attribute filter I configured:

That's not going to work. For starters it's being used as a permit value rule, and not a policy requirement rule. It just doesn't mean anything sensible, and I'm not sure what it would actually do, but my guess is it would filter out all values, which I guess is what it did.

> In the SP attribute policy I configured:

The SP already has a rule for accepting any of the legal values, that's all you need to have there. You don't filter values at the SP unless they're illegal or in some way inappropriate to receive from a given source. That's not where access rules are constructed for resources.

> I am somewhat lost with this. For some reason it seems that both the IdP
> and the SP do not like the AND rule. Anyone any thoughts about this?

You're using the filter policy for user authorization. I think. Or I just don't get what it is you're after.

-- Scott