Using isMemberof Attribute to release specific group membership

[IAM David Bantz]

PolicyRequirementRule for indicating filter poicies to which entities;

 <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="
> https://service.source.com" />
>

  OR is useful to include more than one requestor, but AND makes little
sense

 <PolicyRequirementRule xsi:type="basic:OR">
>         <basic:Rule xsi:type="basic:AttributeRequesterString" value="
> instance.service.com" />
>         <basic:Rule xsi:type="basic:AttributeRequesterString" value="
> another.instance.com" />
>  </PolicyRequirementRule>
>
AttributeRule for conditions for specific attributes



On Wed, Mar 30, 2016 at 11:06 AM, Michael Richter <mrichter at coastal.edu>
wrote:

> So something more like this:
>
> <PolicyRequirementRule xsi:type="AND">
>                         <Rule xsi:type="Requester" value="
> https://e5.onthehub.com" />
>                         <Rule xsi:type="AttributeValueString"
> attributeID="isMemberOf" value="CN=Staff,OU=Groups,DC=coastal"/>
>         </PolicyRequirementRule>
>
>
> When I try to start the IDP I get:
> Cannot resolve 'AttributeValueString' to a type definition for element
> 'Rule'
>
>
> Can I not use this xsi:type in PolicyRequirementRules?
>
> Thanks!
>
> When I try this I get
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
> Scott
> Sent: Wednesday, March 30, 2016 2:17 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: Using isMemberof Attribute to release specific group
> membership
>
> On 3/30/16, 2:04 PM, "users on behalf of Michael Richter" <
> users-bounces at shibboleth.net on behalf of mrichter at coastal.edu> wrote:
>
>
>
> >Thanks for the tips so far.  I think I'm on the right track, but need a
> little assist.
> >In the attribute rule below It's checking for memberships in Staff and
> CSCI.
>
> No, I don't know what that's doing. I think you're telling it to release a
> value only if it matches both of those values, which is completely
> impossible.
>
> The logic you're trying to build belongs in the PolicyRequirement. The
> thing that tells it when to apply the attribute rules in the policy.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160330/ca78b0a3/attachment.html>