Attribute filtering problem with AND on both IdP and SP

[Cantor, Scott]

> In the sense that the IdP will assign the eduPersonAffiliation attribute
> more than one value. For our staff the values would be 'member' and
> 'staff'. For students it would be 'member' and 'student'. The service
> being provided (via the SP) is only for staff. So somewhere, either on
> the IdP or maybe the SP, the attribute values need to be checked.

They need to be checked on the application side, and not in the filter on either side. Filtering on the IdP side in no case will accomplish any sort of authorization since it won't have any effect on whether the login proceeds.

-- Scott