Exclude specific EntityID from attribute-match policy requirement rule?

[Purcell, Brian K]

>>  I also tried to add a NOT rule to the FedServices policy to exclude 
>> that specific EntityID, but the policy would not reload with that.  It's quite possible I had the syntax wrong.

> You must have.

The "ah ha!" moment has arrived.  I was trying to put the NOT rule as a second PolicyRequirementRule, which wasn't kosher.  It didn't occur to me just do it for EPPN itself.

For posterity, here is what fixed it for me: 

<AttributeFilterPolicy id="FedServices">
	<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
		attributeName="https://federation.org/entity-category"
		attributeValue="https://federation.org/category/FedServices" />
	<AttributeRule attributeID="eduPersonPrincipalName">
		<PermitValueRule xsi:type="NOT">
			 <Rule xsi:type="Requester" value="SP EntityID to exclude" />
		</PermitValueRule>
	</AttributeRule>
	<AttributeRule attributeID="email">
		<PermitValueRule xsi:type="ANY" />
	</AttributeRule>
</AttributeFilterPolicy>


--Brian