Attribute Filter policy. Where am I going wrong?

[Cantor, Scott]

On 7/30/15, 10:00 AM, "users on behalf of Rod Widdowson" <users-bounces at shibboleth.net on behalf of rdw at steadingsoftware.com> wrote:



>> It's arguably simpler if you do. For example, N-ary OR can be implemented
>as
>> "iterate over the things, return true for the first one that returns true;
>> otherwise false". 0-ary OR ends up being false, of course. No need for
>special
>> cases.
>
>I know, but that’s why I dislike it.  It turns a misconfiguration into a
>success which probably doesn't do anything like what you expect.

And likely isn't really all that useful anyway since about the only use case for it is commenting out the content, and you can just comment out the whole policy to get the same effect.

I guess the rule of thumb is, whatever you think minOccurs *should* be, subtract 1.

-- Scott