Attribute Filter Feedback

[Rod Widdowson]

> Is it the correct way to do so as follows?
> 
> <Rule xsi:type="Value" attributeID="groupMembership" value="cn=ENGL_101_*,ou=example,dc=edu" />
> 
> And this will allow: "cn=ENGL_101_T4EVENING,ou=example,dc=edu"; "cn=ENGL_101_S2MORNING,ou=example,dc=edu" etc?

No, that will check against the exact value of the string so only  "cn=ENGL_101_*,ou=example,dc=edu"

You need the value regexp matcher [1] and good luck with that.  Regexps are 'difficult'

> 
> I got a bit lost on options.... configuring a new IdP (leaping from early v2 to v3.3).

I'm not sure what you are asking here.  Modulo some syntactic cleanup V3.3 is the same as V2.  An important difference is that I (tried to) define the precise semantics of what filtering does [2].  You might want to read that.

In general the rule for filtering is to not think too hard about it and it will "do what you expect".  As soon as you try to be clever you will discover that the language will defeat you (often in subtle and disturbing ways)

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ValueRegexConfiguration 
[2] https://wiki.shibboleth.net/confluence/display/IDP30/AttributeFilterConfiguration#AttributeFilterConfiguration-Semantics

>     <AttributeFilterPolicy id="Internal">
>       <PolicyRequirementRule xsi:type="AND">
>         <Rule xsi:type="OR">
>           <Rule xsi:type="Value" attributeID="memberOf" value="cn=test,ou=example,dc=edu"/>
>           <Rule xsi:type="Value" attributeID="groupMembership" value="cn=ENGL_101_*,ou=example,dc=edu" />
>         </Rule>
>         <Rule xsi:type="Requester" value="https://sp-entity-id"/>
>       </PolicyRequirementRule>

So.. 

Apply the rules below iff
       memberOf is EXACTLY "cn=test,ou=example,dc=edu" OR groupMembership is EXACTLY " cn=ENGL_101_*,ou=example,dc=edu "
       AND the requester (SP) is EXACTLY ="https://sp-entity-id"

(Only for my test SP if either of the attributes has a value I care about) 

If so then

> 
>             <AttributeRule attributeID="givenName">
>                     <PermitValueRule xsi:type="ANY" />
>             </AttributeRule>

Release all values of givenName


>             <AttributeRule attributeID="sn">
>                     <PermitValueRule xsi:type="ANY" />
>             </AttributeRule>

Release all values of sn

 
>             <AttributeRule attributeID="displayName">
>                 <PermitValueRule xsi:type="ANY" />
>             </AttributeRule>

Release all values of displayName

>             <AttributeRule attributeID="mail">
>                 <PermitValueRule xsi:type="ANY"/>
>             </AttributeRule>

Release all values of mail