Using isMemberof Attribute to release specific group membership

[Michael Richter]

Thanks for the tips so far.  I think I'm on the right track, but need a little assist.
In the attribute rule below It's checking for memberships in Staff and CSCI.  If evaluated as true, it will return the entire ismemberof attribute.  If I can get it to just release a specific value(in this case CSCI) after evaluating the AND statement, I think I may be in business.  Is this possible, or I'm I heading down a dead end path.  Thanks again for all the help!

<AttributeRule attributeID="isMemberOf">
             <PermitValueRule xsi:type = "basic:AND">
		<Rule xsi:type="Value" value="CN=Staff,OU=Groups,DC=coastal,DC=edu"/>
		<Rule xsi:type="Value" value="CN=CSCI,OU=Groups,DC=coastal,DC=edu"/>
	 </PermitValueRule>
</AttributeRule>

Mike

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, March 30, 2016 1:09 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Using isMemberof Attribute to release specific group membership

On 3/30/16, 12:57 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>From my experience, it makes sense to release all values that the service provider might potentially be interested in, then let the SP decide what to do with it. In your case, I'd release all three possible values to the SP and let it give access based on the highest possible value.

It really depends. If that means releasing 100 values, including all your course enrollments, probably not so much.

>Seems like, to do it from the IDP, you'd need to invent a new attribute (it could have the same oid as isMemberOf) and populate it with the highest possible group using a scripted attribute definition. This is more complex and less elegant, though, then just letting the SP make the decision.

That is one way, just depends on how much knowledge you can bake into the IdP (or maybe more to the point the IDM side, where you could produce custom groups for an application so it gets only the data it needs).

Anyway, if you want to do it in the filter, you create a policy whose PolicyRequirementRule is based on the value of an attribute, and then release the data you want in that case.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net