eduPersonEntitlement with 2 conditions

[Cantor, Scott]

> Is this correct? a good approach?

No. You can't *create* anything with a filter rule. If you have an entitlement in existence and want to control its release, that's a filter rule. Creating anything is the resolver's job.

There are no AttributeDefinitions that explicitly create values based on the SP. A script can natively just create values based on any inputs, or you could create an entitlement via a Mapped definition based on the other attribute/value, and then either conditionalize the definition on the SP via activation condition, or produce it regardless (*) and release it with a filter rule based on the SP.

-- Scott

(*) I wouldn't ideally produce any entitlements based on directory data in the IdP either, I'd expect a competently run IDM system to do it for me. Or I'd be demanding some of the budget of the IDM team that's not doing their job at my institution, if I was asked to do it for them. The IdP tends to be valuable when the entitlements are dependent on other, contextual data and not just the identity information.