Attribute Filter Feedback

[Jann Malenkoff]

I'm trying to filter access on a group of students in ENGL101 -- it's a
large class, so there are numerouse groups.

Is it the correct way to do so as follows?

<Rule xsi:type="Value" attributeID="groupMembership"
value="cn=ENGL_101_*,ou=example,dc=edu" />

And this will allow: "cn=ENGL_101_T4EVENING,ou=example,dc=edu";
"cn=ENGL_101_S2MORNING,ou=example,dc=edu" etc?

I got a bit lost on options.... configuring a new IdP (leaping from early
v2 to v3.3).

    <AttributeFilterPolicy id="Internal">
      <PolicyRequirementRule xsi:type="AND">
        <Rule xsi:type="OR">
          <Rule xsi:type="Value" attributeID="memberOf"
value="cn=test,ou=example,dc=edu"/>
          <Rule xsi:type="Value" attributeID="groupMembership"
value="cn=ENGL_101_*,ou=example,dc=edu" />
        </Rule>
        <Rule xsi:type="Requester" value="https://sp-entity-id"/>
      </PolicyRequirementRule>

            <AttributeRule attributeID="givenName">
                    <PermitValueRule xsi:type="ANY" />
            </AttributeRule>

            <AttributeRule attributeID="sn">
                    <PermitValueRule xsi:type="ANY" />
            </AttributeRule>

            <AttributeRule attributeID="displayName">
                <PermitValueRule xsi:type="ANY" />
            </AttributeRule>

            <AttributeRule attributeID="mail">
                <PermitValueRule xsi:type="ANY"/>
            </AttributeRule>

    </AttributeFilterPolicy>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170712/b234cb97/attachment.html>