[EXTERN] Re: Using "and" combined with "not" in a policyrequirementrule?

[Tomas Liljebergh]

Thank you!
It was the </Rule> at the end i was missing.

Not it seams to work.

//Tomas
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Bernd Oberknapp <bo at ub.uni-freiburg.de>
Sent: Wednesday, July 2, 2025 13:22
To: users at shibboleth.net <users at shibboleth.net>
Subject: Re: [EXTERN] Re: Using "and" combined with "not" in a policyrequirementrule?

Based on similar rules we have for limiting the release of attributes for test
accounts to specific SPs, this should work:

<PolicyRequirementRule xsi:type="AND">
     <Rule xsi:type="Requester" value="https://aaa.bbb.com"/>
     <Rule xsi:type="NOT">
         <Rule xsi:type="Value" attributeID="some_attribute" value="working" />
     </Rule>
</PolicyRequirementRule>

Best regards,
Bernd


On 02.07.25 13:07, Tomas Liljebergh via users wrote:
> Thanks for checking, but when i try this:
>
> <Rule xsi:type="NOT"/>
>    <Rule  xsi:type="Something" attributeValue="working"
> attributeName="some_attribute" />
> </Rule>
>
>
> It says "Line XX in XML document from file [/opt/shibboleth-idp/conf/
> attribute-filter-custom.xml] is invalid
>
> with the error on this line <Rule xsi:type="NOT"/>
> Also tested with removing the / but with the same problem.
>
>
>
> //Tomas
>
> ------------------------------------------------------------------------------
> *From:* users <users-bounces at shibboleth.net> on behalf of Rod Widdowson
> <rdw at steadingsoftware.com>
> *Sent:* Wednesday, July 02, 2025 11:38
> *To:* 'Shib Users' <users at shibboleth.net>
> *Subject:* RE: Using "and" combined with "not" in a policyrequirementrule?
>
> I don't have the AttributeFilter syntaxt swapped in right now but
>
>  > Is this possible?
>
> Yes
>
>  > If so how should i write the rule? I cant get it working
>
> What is failing, does it not work or does it not start?  Like I say, I don’t
> have the syntax swapped in right now, but off the top of my head
>
>  >  <Rule xsi:type="NOT" attributeValue="working"
> attributeName="some_attribute" />
>
> Looks dodgy.  I would have expected to see
>
> <Rule xsi:type="NOT"/>
>    <Rule  xsi:type="Something" attributeValue="working"
> attributeName="some_attribute" />
> </Rule>
>
>
>
> --
> For Consortium Member technical support, see https://shibboleth.atlassian.net/
> wiki/x/ZYEpPw <https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

--
Bernd Oberknapp
Gesamtleitung ReDI

Albert-Ludwigs-Universität Freiburg
Universitätsbibliothek
Platz der Universität 2 | Postfach 1629
D-79098 Freiburg        | D-79016 Freiburg

Telefon:  +49 761 203-3852
Telefax:  +49 761 203-3987
E-Mail:   bo at ub.uni-freiburg.de
Internet: www.ub.uni-freiburg.de<http://www.ub.uni-freiburg.de>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250702/09059797/attachment.htm>