Apache access rules with multi-valued Attributes?

[Bryan K. Walton]

I'm trying to get Apache access controls configured properly for my SP
that is talking with an IdP that is passing us an attribute with 
multiple values.  Here is an abbreviated example of what are seeing in 
the decrypted SAML assertion:

<saml2:Attribute Name="employeeType" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">CN=ROLE.FUNC APP Alertus Admins</saml2:AttributeValue>
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">CN=ROLE.APP Banner PCC_EMPLOYEE_ACTIVE_NONSTU</saml2:AttributeValue>
<saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">CN=ROLE.APP Banner PCC_EMPLOYEE_ACTIVE</saml2:AttributeValue>
</saml2:Attribute>

I have the attribute mapped correctly, I do see it in the transaction
log. Now, I'm trying to use an Apache access rules like this:
require shib-attr employeeType ~ ^.*PCC_EMPLOYEE_ACTIVE.*$

However, it isn't working.  My apache error log is showing:
authorization result of Require shib-attr employeeType ~ ^.*PCC_EMPLOYEE_ACTIVE.*$: denied

I've done shib-attr configurations like this before.  However, I've
never had an IdP send me multiple AttributeValues inside an Attribute.
Can I make this work?  Is the problem with my Apache access regex or is
it somehow related to the multi-value attribute?

Thanks,
Bryan Walton

-- 
Bryan K. Walton						  319-337-3877 
Senior Linux Systems Administrator	    Leepfrog Technologies, Inc