eduPersonEntitlement with 2 conditions

[Robert Duncan]

Hi,
Looking for some guidance/comments on the following

How to set a static entitlement value with two conditions
the requester SP  e.g. https://sp.example.com
a qualifying affiliation e.g. staff at institution.com

I asked ChatGPT which answered with the following,

To set the value of eduPersonEntitlement based on the two conditions you mentioned, you can use the "Attribute Filter" feature in Shibboleth IdP. Here are the steps to set it up:

In the Shibboleth IdP configuration, locate the "attribute-filter.xml" file. This file defines the rules for filtering and modifying attributes.

Create a new rule for the "eduPersonEntitlement" attribute by adding the following lines to the "attribute-filter.xml" file:

<AttributeFilterPolicy>
  <PolicyRequirementRule xsi:type="Requester" value="https://sp.example.com/" />
  <AttributeRule attributeID="eduPersonEntitlement">
    <PermitValueRule xsi:type="AND">
      <Rule xsi:type="AttributeValueRegexp" regex=".*staff at institution\.com$" />
    </PermitValueRule>
  </AttributeRule></AttributeFilterPolicy>

This rule says that the "eduPersonEntitlement" attribute will be released only if the requesting SP entityID is equal to 'https://sp.example.com/' and the user has an eduPersonScopedAffiliation equal to 'staff at institution.com'.

Save the "attribute-filter.xml" file and restart the Shibboleth IdP.

Test the rule by logging in to the Shibboleth IdP and accessing a service provider with entityID 'https://sp.example.com/'. Check that the "eduPersonEntitlement" attribute is released only if the user has an eduPersonScopedAffiliation equal to 'staff at institution.com'.

Note that the regex expression in the rule above matches any value of eduPersonScopedAffiliation that ends with '@institution.com'. If you need to match a specific value, you can modify the regex accordingly.

Is this correct? a good approach?

thanks,

Rob.









________________________________

The information contained and transmitted in this e-mail is confidential information, and is intended only for the named recipient to which it is addressed. The content of this e-mail may not have been sent with the authority of National College of Ireland. Any views or opinions presented are solely those of the author and do not necessarily represent those of National College of Ireland. If the reader of this message is not the named recipient or a person responsible for delivering it to the named recipient, you are notified that the review, dissemination, distribution, transmission, printing or copying, forwarding, or any other use of this message or any part of it, including any attachments, is strictly prohibited. If you have received this communication in error, please delete the e-mail and destroy all record of this communication. Thank you for your assistance.
________________________________