IDP controlling access to SPs based on user attribute

[Ho, PeiQuan]

Hi,

               I'm using IDP 3.2.0.  It is possible for the IDP to control user access to an SP based on the attribute values of the user?  This article seems to indicate that that can be done.
https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration

But, when I just take the existing example and edit it slightly for our environment, I'm not seeing any conditions being applied against the attribute values.  I don't see anything in the logs regarding the intercept either.  (I'm also not sure which class to increase the logging for)

Below are my changes.  For testing, I'm looking to deny users to WebEx based on attribute value "uid"... in this case, all users would be denied.

    <bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND">
        <constructor-arg>
            <list>
                <bean parent="shibboleth.Conditions.RelyingPartyId" c: candidates="#{ 'https://tufts-test.webex.com' }" />
                <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
                        p:useUnfilteredAttributes="true">
                    <property name="attributeValueMap">
                        <map>
                            <entry key="uid">
                                <list>
                                    <value>FAKE</value>
                                </list>
                            </entry>
                        </map>
                    </property>
                </bean>
            </list>
        </constructor-arg>
    </bean>

Thanks,
-PQ

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161031/ea4670d0/attachment-0001.html>