Regex in attribute-filter.xml

[Zhang, Xiaoling]

Hi,

After upgrading our IdP to 3.2.1, we noticed some AFPs in the legacy attribute-filter.xml are not working as expected. For example, the following configuration releases eduPersonEntitlement values that begin with “abcde” in IdP2 but releases ALL entitlement values in the IdP3:

  <AttributeRule attributeID="eduPersonEntitlement">
      <PermitValueRule regex="^abcde.*$" xsi:type="basic:AttributeValueRegex"/>
  </AttributeRule>

And this configuration releases ALL values of eduPersonAffiliation rather than “employee” only:

<basic:Rule attributeID="eduPersonAffiliation" value=“employee” xsi:type="basic:AttributeValueString"/>


We understand that following configurations work:

  <AttributeRule attributeID="eduPersonEntitlement">
        <PermitValueRule xsi:type="ValueRegex" regex="^abcde.*$" />
  </AttributeRule>

  <AttributeRule attributeID="eduPersonAffiliation">
        <PermitValueRule value="employee" xsi:type="Value"/>
  </AttributeRule>

However, at UCLA we have over 700 AFPs and lots of them have configurations like above. We were wondering if there are ways to make the legacy configurations work while we make the changes.

Thanks in advance.

Xiaoling Zhang
UCLA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160607/0e96ef17/attachment-0001.html>