Using isMemberof Attribute to release specific group membership

[Michael Richter]

Hello all,
    I'm trying to do something that should be (and may be) easy.  I'm still new to Shibboleth and may be missing something, but I've spent the last day trying to figure this out.

I need to release a group membership based on specific criteria.  Basically we have a site that has 3 levels of access,  CompSci, Faculty, Staff (from highest privileged to least).  I'd like to release the group membership that matches the highest privilege the user is entitled to.  Below is where I am

I have my attribute resolver populating the isMemberOf attribute with a list of all groups the user is a member of.   Then in my attribute-filter.xml I use the following rule to release the group name.

<AttributeRule attributeID="isMemberOf">
             <PermitValueRule xsi:type="Value" value="CN=Staff,OU=Groups,DC=coastal,DC=edu"/>
</AttributeRule>

This sends the single group membership.  This would work if I was looking for a single group, but I need to prioritize.  Is it possible in the Attribute filter to set a rule to try to match the "CompSci" group first and then stop if it is found, but if it is not found then move on to the next rule that will try to match the "Faculty" group and send it if found.  This would allow me to only send the group that has highest level of privileges allowed to the user.

Any help would be appreciated.  Thanks!

Mike Richter


Mike Richter
ITS System Administrator
Coastal Carolina University

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160330/f09e058c/attachment-0001.html>