Attribute Filter Policy with multiple NOT

[Adam Portier]

Good morning,

I am working on an integration with an external SP for our college. Under
our current filter policy, we release the same set of attributes to all SPs
*except* one, which doesn't handle unexpected attributes in the release
well. It looks something like this right now:

<AttributeFilterPolicy id="default">

        <PolicyRequirementRule xsi:type="NOT">
            <Rule xsi:type="Requester" value="problem-sp.com" />
        </PolicyRequirementRule>
...

I the new SP I am working on integrating has very similar problems with
unexpected attributes. Rather than changing the policy to explicitly list
out every SP allowed to use it with an AND, I would like to extend the NOT
to handle 2 SPs. Here is what I think should work, but is throwing an error
in the logs.

<AttributeFilterPolicy id="default">

        <PolicyRequirementRule xsi:type="NOT">
            <Rule xsi:type="Requester" value="problem-sp.com" />
            <Rule xsi:type="Requester" value="problem-sp2.com" />
        </PolicyRequirementRule>
...

I have dug through the mailing list archives and could not find an answer
to this problem. I have also reviewed the schema, and what I am doing
should not be a violation (if I understand it correctly, which I likely do
not). I have tried creating a nested set of PolicyRequirementRule blocks
that either have multiple NOT rules inside an OR rule, or a NOT rule
containing a single OR rule. Nothing has worked so far. If anyone has had
success creating a filter policy that permits multiple NOT rules, I would
appreciate some pointers.

Thank you.

-- 
Adam Portier
Linux Administrator
IITS Core Technologies
Haverford College
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170331/dd3afc97/attachment.html>