Flow-Intercept-Allowed-Beans

[Joshua Brodie]

Hi List.

This has been stumping me, and wondering if any can guide me through my
mental fog.

We have the following condition to allow access to an SP -- the IdP
intercepts is condition is not met and present a message to say access
denied.

How do I add an additional 'OR' condition for groupMembership? I.e. allow
access if in eduPersonAffiliation (with values in list below) OR if member
in a groupMembership?


<bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND">
        <constructor-arg>
             <list>
                 <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidates="#{{'http://www.sp.example.com/sp'}}" />
                 <bean
class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
                         p:useUnfilteredAttributes="true">
                          <property name="attributeValueMap">
                        <map>
                            <entry key="eduPersonAffiliation">
                                <list>
                                    <value>faculty</value>
                                    <value>staff</value>
                                    <value>guest</value>
                                </list>
                            </entry>
                        </map>
                    </property>
                    </bean>
             </list>
</constructor-arg>
    </bean>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190409/d95c65cb/attachment.html>