Using isMemberof Attribute to release specific group membership

[Nicholas Rodrigues]

We have a connection that is based on a memberOf AD Security Group, not
sure this would work in your case, but here is what we use:

<AttributeRule attributeID="eduPersonEntitlement">
        <PermitValueRule xsi:type="basic:OR">
                      <basic:Rule xsi:type="basic:AttributeValueString"
value="urn:mace:calstate.edu:csumb.edu:memberOf:IPTV" ignoreCase="true" />
                      <basic:Rule xsi:type="basic:AttributeValueString"
value="urn:mace:calstate.edu:csumb.edu:memberOf:CSUMB - IPTV"
ignoreCase="true" />
</PermitValueRule>


Nick Rodrigues
*Identity & Security Analyst*
California State University, Monterey Bay
831-582-3320
http://it.csumb.edu

On Wed, Mar 30, 2016 at 11:16 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/30/16, 2:04 PM, "users on behalf of Michael Richter" <
> users-bounces at shibboleth.net on behalf of mrichter at coastal.edu> wrote:
>
>
>
> >Thanks for the tips so far.  I think I'm on the right track, but need a
> little assist.
> >In the attribute rule below It's checking for memberships in Staff and
> CSCI.
>
> No, I don't know what that's doing. I think you're telling it to release a
> value only if it matches both of those values, which is completely
> impossible.
>
> The logic you're trying to build belongs in the PolicyRequirement. The
> thing that tells it when to apply the attribute rules in the policy.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160330/4a06c67c/attachment.html>