Exclude specific EntityID from attribute-match policy requirement rule?

[Mak, Steve]

You should just setup a separate filter rule to DENY those attributes to that EntityID. Deny rules always trump Allow rules.
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Purcell, Brian K <purcell at uthscsa.edu>
Sent: Monday, February 14, 2022 5:49 PM
To: users at shibboleth.net <users at shibboleth.net>
Subject: Exclude specific EntityID from attribute-match policy requirement rule?

Is there a way to exclude a specific EntityID from an attribute-match policy requirement rule in the attribute filter policy?  Specifically, I'm trying to exclude one specific EntityID that matches on the following policy because I need to do a custom EPPN for them that converts it to all upper case.

<AttributeFilterPolicy id="FedServices">
        <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
                attributeName="https://urldefense.com/v3/__https://federation.org/entity-category__;!!IBzWLUs!G_dE24OyYe9vpKK3njqU4YFeou7zR001ztZw0uRJ92xzWvN7SwwQ1ccFH1YT4A$ "
                attributeValue="https://urldefense.com/v3/__https://federation.org/category/FedServices__;!!IBzWLUs!G_dE24OyYe9vpKK3njqU4YFeou7zR001ztZw0uRJ92xzWvN7SwwQ1cd9Ay7m_A$ " />
        <AttributeRule attributeID="eduPersonPrincipalName">
                <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
        <AttributeRule attributeID="email">
                <PermitValueRule xsi:type="ANY" />
        </AttributeRule>
</AttributeFilterPolicy>

I tried adding a second filter policy for that EntityID that uses the custom upper case EPPN, but that causes two instances of EPPN to be in the SAML response with the lower case one coming first, and it looks like the application consumes the first one in the response.  So I tried moving that specific policy higher in attribute-filter.xml than the FedServices policy, but that didn't make any difference.  I also tried to add a NOT rule to the FedServices policy to exclude that specific EntityID, but the policy would not reload with that.  It's quite possible I had the syntax wrong.

The metadata for this SP is coming to us via federation metadata, so I'm not able to remove the attribute from the metadata.

Thanks in advance for any suggestions.

--Brian Purcell
IT Systems Architect
UT Health San Antonio

--
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!G_dE24OyYe9vpKK3njqU4YFeou7zR001ztZw0uRJ92xzWvN7SwwQ1cdI2FQfvA$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220215/7c7a996d/attachment.htm>