Attribute filtering problem with AND on both IdP and SP

[John Horne]

On Thu, 2015-02-12 at 23:17 +0000, Cantor, Scott wrote:
> > For a particular SP (which we run; version 2.5.3) I am trying to ensure
> > that the eduPersonAffiliation attribute contains both 'member' and
> > 'staff'. It can contain other things, but must have these two values.
>
> I think that would be an authz rule, not a filtering thing.
>
> Must have those values in what sense?
> 
In the sense that the IdP will assign the eduPersonAffiliation attribute
more than one value. For our staff the values would be 'member' and
'staff'. For students it would be 'member' and 'student'. The service
being provided (via the SP) is only for staff. So somewhere, either on
the IdP or maybe the SP, the attribute values need to be checked.

> > In the IdP (version 2.4.1) attribute filter I configured:
> 
> That's not going to work. For starters it's being used as a permit
> value rule, and not a policy requirement rule.
>
Ah. Good point. I'll try that tomorrow.

> > In the SP attribute policy I configured:
...
> You're using the filter policy for user authorization. 
>
True, and I appreciate that it might not be appropriate.




John.

-- 
----------------------------------------------------
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK