Authorization shibboleth.context-check.Condition

[Joshua Brodie]

Thanks Scott!

Would you have any suggestion on how to leverage the OR scenario?

I thought of writing a script in attribute-resolver that mung-es the
eduPersonEntitlement value (https://example.edu/employee/active) and the
memberOf value (cn=adhoc,ou=example,ou=edu) --- into a new
eduPersonEntitleent value.

Not too sure if that is the best way forward?

On 23 June 2017 at 06:21, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/23/17, 4:57 AM, "users on behalf of Joshua Brodie" <
> users-bounces at shibboleth.net on behalf of josbrodie at gmail.com> wrote:
>
> > Have I followed good practice with 'shibboleth.context-check.Condition'
> as shown below -- I haven't been able to test if it works
> > and suspense if this is correct (test ldap down).
>
> The SimpleAttributePredicate class treats separate attributes as an AND
> (conjunction), not an OR. So no, it won't match what you wrote out in
> English.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170623/431f90bb/attachment.html>