IDP3 - Trying to only allow certain users

[Klingenstein, Nate]

Gary,

> I am trying to create a filter, that only allows certain users to use an SP.

Your fundamental question: can the SP check an attribute to do this gating?

If yes, good.

If no, see:

https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration

> I have created an nsrole in ldap, and only want users with this role to be
> able to use this SP. I read the wiki pages, which are great btw, but... 
> I am using IDP3, and I am guessing I dont quite understand how
> "basic:AttributeValueString" works in filters.
> 
> AttributeValueString - Evaluates to true if the value of a given attribute
> matches a given string

I think it's supposed to be just plain "Value" now.  Your configuration may be getting slurped into the v2 emulator and working.

https://wiki.shibboleth.net/confluence/display/IDP30/AttributeFilterPolicyConfiguration#AttributeFilterPolicyConfiguration-CommonRuleTypes

Anyway, are you injecting literal quotes into your "true" turning it into "true" as a string and not true, and thus it's not matching true?

https://wiki.shibboleth.net/confluence/display/IDP30/MappedAttributeDefinition

>            <Rule xsi:type="basic:AttributeValueString" attributeID="slack"
> value="true" ignoreCase="true" />

>        <ad:ValueMap>
>            <ad:ReturnValue>"true"</ad:ReturnValue>
> 
> <ad:SourceValue>cn=slack,ou=SOMEOU,ou=ANOTHEROU,o=SOMEORG,c=us</ad:SourceValue>
>        </ad:ValueMap>
> 

Hope this helps,
Nate.