Attribute filtering problem with AND on both IdP and SP

[IAM David Bantz]

OR in the IdP attribute-filter rule means release each ePA value if the
value matches "staff" OR the value matches "member"; that seems to mirror
your intent to release both values.

No value of ePA will match both "staff" AND match "member" so that
guarantees no value released.





On Thu, Feb 12, 2015 at 1:57 PM, John Horne <john.horne at plymouth.ac.uk>
wrote:

> Hello,
>
> For a particular SP (which we run; version 2.5.3) I am trying to ensure
> that the eduPersonAffiliation attribute contains both 'member' and
> 'staff'. It can contain other things, but must have these two values.
>
> In the IdP (version 2.4.1) attribute filter I configured:
>
> ===================
> <afp:AttributeRule attributeID="eduPersonAffiliation">
>   <afp:PermitValueRule xsi:type="basic:AND">
>      <basic:Rule xsi:type="basic:AttributeValueString" value="staff"/>
>      <basic:Rule xsi:type="basic:AttributeValueString" value="member"/>
>   </afp:PermitValueRule>
> </afp:AttributeRule>
> ===================
>
> In the SP attribute policy I configured:
>
> ===================
> <afp:AttributeRule attributeID="eduPersonAffiliation">
>   <afp:PermitValueRule xsi:type="basic:AttributeValueRegex"
> regex=".+" />
> </afp:AttributeRule>
> ===================
>
> However, the IdP produces no final attribute, and (obviously) the SP
> sees nothing. Both the IdP and SP logs indicate this.
>
> If I put the AND into the SP, and configure the IdP to release ANY value
> for eduPersonAffiliation, then the IdP indicates the attribute has 2
> values and releases them. The SP sees two values (the log shows that
> they are 'staff' and 'member'), but removes them and so ends up with no
> attribute again.
>
> If I change the AND to an OR (on the IdP or the SP), then it works fine.
>
> I am somewhat lost with this. For some reason it seems that both the IdP
> and the SP do not like the AND rule. Anyone any thoughts about this?
>
>
>
> Thanks,
>
> John.
>
> --
> ----------------------------------------------------
> John Horne                   Tel: +44 (0)1752 587287
> Plymouth University, UK
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150212/54187fbb/attachment.html