How to setup rules based on attribute values

[nr673 .]

Hi:

I have configured shibboleth SP(Ver 2.5.3) to work with the two IdPs (OKTA1
& OKTA2).

   <MetadataProvider type="Chaining">
      <MetadataProvider type="XML" file="/etc/shibboleth/Okta1.xml"/>
      <MetadataProvider type="XML" file="/etc/shibboleth/Okta2.xml"/>
   </MetadataProvider>

I am getting the Email, UserName, FirstName, & LastName as attributes from
IdP.

I want to enforce a rule in such a way that the email address of the users
authenticated through OKTA1 must have @abc.com as their domain address and
OKTA2 users must have @xyz.com as the domain address.

Is it possible to enforce this rule? If the email attribute does not follow
the rule, can we reject the incoming request?

If yes, can you please give me some documentation or example on how to
proceed on this?

Thanks

Nara
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150617/d740a3f0/attachment.html>