Using isMemberof Attribute to release specific group membership

[Michael Richter]

So something more like this:

<PolicyRequirementRule xsi:type="AND">
			<Rule xsi:type="Requester" value="https://e5.onthehub.com" />
			<Rule xsi:type="AttributeValueString" attributeID="isMemberOf" value="CN=Staff,OU=Groups,DC=coastal"/>
        </PolicyRequirementRule>

 
When I try to start the IDP I get:
Cannot resolve 'AttributeValueString' to a type definition for element 'Rule'


Can I not use this xsi:type in PolicyRequirementRules?

Thanks!

When I try this I get 
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, March 30, 2016 2:17 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Using isMemberof Attribute to release specific group membership

On 3/30/16, 2:04 PM, "users on behalf of Michael Richter" <users-bounces at shibboleth.net on behalf of mrichter at coastal.edu> wrote:



>Thanks for the tips so far.  I think I'm on the right track, but need a little assist.
>In the attribute rule below It's checking for memberships in Staff and CSCI.

No, I don't know what that's doing. I think you're telling it to release a value only if it matches both of those values, which is completely impossible.

The logic you're trying to build belongs in the PolicyRequirement. The thing that tells it when to apply the attribute rules in the policy.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net