Using isMemberof Attribute to release specific group membership

[Michael Richter]

Ok,  I’m on my way.  I’m using the PolicyRequriementRule to require the requester and that the memberof attribute contain the group needed.  Now to finish, I’ll need to set up another AttributeFilter Policy which is fine, but is it possible to use both ANDs and NOT in A PolicyRequirementRule?  I’d like to specify that a user be a member of the Faculty, but not a member of the Comp Sci group.  I can see how to set the rules individually, but not in combination.  Thanks!
Mike

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of IAM David Bantz
Sent: Wednesday, March 30, 2016 3:17 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Using isMemberof Attribute to release specific group membership

PolicyRequirementRule for indicating filter poicies to which entities;

 <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://service.source.com" />

  OR is useful to include more than one requestor, but AND makes little sense

 <PolicyRequirementRule xsi:type="basic:OR">
        <basic:Rule xsi:type="basic:AttributeRequesterString" value="instance.service.com<http://instance.service.com>" />
        <basic:Rule xsi:type="basic:AttributeRequesterString" value="another.instance.com<http://another.instance.com>" />
 </PolicyRequirementRule>
AttributeRule for conditions for specific attributes



On Wed, Mar 30, 2016 at 11:06 AM, Michael Richter <mrichter at coastal.edu<mailto:mrichter at coastal.edu>> wrote:
So something more like this:

<PolicyRequirementRule xsi:type="AND">
                        <Rule xsi:type="Requester" value="https://e5.onthehub.com" />
                        <Rule xsi:type="AttributeValueString" attributeID="isMemberOf" value="CN=Staff,OU=Groups,DC=coastal"/>
        </PolicyRequirementRule>


When I try to start the IDP I get:
Cannot resolve 'AttributeValueString' to a type definition for element 'Rule'


Can I not use this xsi:type in PolicyRequirementRules?

Thanks!

When I try this I get
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>] On Behalf Of Cantor, Scott
Sent: Wednesday, March 30, 2016 2:17 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Using isMemberof Attribute to release specific group membership
On 3/30/16, 2:04 PM, "users on behalf of Michael Richter" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of mrichter at coastal.edu<mailto:mrichter at coastal.edu>> wrote:



>Thanks for the tips so far.  I think I'm on the right track, but need a little assist.
>In the attribute rule below It's checking for memberships in Staff and CSCI.

No, I don't know what that's doing. I think you're telling it to release a value only if it matches both of those values, which is completely impossible.

The logic you're trying to build belongs in the PolicyRequirement. The thing that tells it when to apply the attribute rules in the policy.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160330/0212bcfe/attachment-0001.html>