[EXTERN] Re: Using "and" combined with "not" in a policyrequirementrule?

[Bernd Oberknapp]

Based on similar rules we have for limiting the release of attributes for test 
accounts to specific SPs, this should work:

<PolicyRequirementRule xsi:type="AND">
     <Rule xsi:type="Requester" value="https://aaa.bbb.com"/>
     <Rule xsi:type="NOT">
         <Rule xsi:type="Value" attributeID="some_attribute" value="working" />
     </Rule>
</PolicyRequirementRule>

Best regards,
Bernd


On 02.07.25 13:07, Tomas Liljebergh via users wrote:
> Thanks for checking, but when i try this:
> 
> <Rule xsi:type="NOT"/>
>    <Rule  xsi:type="Something" attributeValue="working" 
> attributeName="some_attribute" />
> </Rule>
> 
> 
> It says "Line XX in XML document from file [/opt/shibboleth-idp/conf/ 
> attribute-filter-custom.xml] is invalid
> 
> with the error on this line <Rule xsi:type="NOT"/>
> Also tested with removing the / but with the same problem.
> 
> 
> 
> //Tomas
> 
> ------------------------------------------------------------------------------
> *From:* users <users-bounces at shibboleth.net> on behalf of Rod Widdowson 
> <rdw at steadingsoftware.com>
> *Sent:* Wednesday, July 02, 2025 11:38
> *To:* 'Shib Users' <users at shibboleth.net>
> *Subject:* RE: Using "and" combined with "not" in a policyrequirementrule?
> 
> I don't have the AttributeFilter syntaxt swapped in right now but
> 
>  > Is this possible?
> 
> Yes
> 
>  > If so how should i write the rule? I cant get it working
> 
> What is failing, does it not work or does it not start?  Like I say, I don’t 
> have the syntax swapped in right now, but off the top of my head
> 
>  >  <Rule xsi:type="NOT" attributeValue="working" 
> attributeName="some_attribute" />
> 
> Looks dodgy.  I would have expected to see
> 
> <Rule xsi:type="NOT"/>
>    <Rule  xsi:type="Something" attributeValue="working" 
> attributeName="some_attribute" />
> </Rule>
> 
> 
> 
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/ 
> wiki/x/ZYEpPw <https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

-- 
Bernd Oberknapp
Gesamtleitung ReDI

Albert-Ludwigs-Universität Freiburg
Universitätsbibliothek
Platz der Universität 2 | Postfach 1629
D-79098 Freiburg        | D-79016 Freiburg

Telefon:  +49 761 203-3852
Telefax:  +49 761 203-3987
E-Mail:   bo at ub.uni-freiburg.de
Internet: www.ub.uni-freiburg.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6302 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20250702/3df831f4/attachment.p7s>