<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>In my setup I assign every known values of ePe to all users in the resolver and then attempt to filter the values based on some other attributes value.</div><div><br></div><div><div>But I think what I'm trying to do cannot be achieved due the limitation that "Each attribute rule contains one and only one value rule." (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter#IdPAddAttributeFilter-3DefineAttributeRules">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter#IdPAddAttributeFilter-3DefineAttributeRules</a> )</div></div><div><br></div><div>this is what I've come up with…</div><div><br></div><div><br></div><div> <afp:AttributeRule attributeID="eduPersonEntitlement" xsi:type="basic:OR"></div><div> <basic:Rule xsi:type="AttributeValueRegex" attributeID="distinguishedName" regex="^OU=ComputerScience.*$"></div><div> <afp:PermitValueRule xsi:type="basic:OR"> </div><div> <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace:heanet.ie:edugate:sp:onthehub:13209481" ignoreCase="true"/></div><div> <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace:heanet.ie:edugate:sp:onthehub:14556661" ignoreCase="true"/></div><div> </afp:PermitValueRule></div><div> </basic:Rule></div><div> <basic:Rule xsi:type="basic:AttributeValueRegex" attributeID="distinguishedName" regex="^OU=HumanitiesStudent.*$"></div><div> <afp:PermitValueRule xsi:type="basic:OR"> </div><div> <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace-dir:heanet.ie:edugate:sp:onthehub:69303931" ignoreCase="true"/></div><div> <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace-dir:heanet.ie:edugate:sp:onthehub:98632322" ignoreCase="true"/></div><div> </afp:PermitValueRule></div><div> </basic:Rule></div><div> </afp:AttributeRule></div><div><br></div><div>This raises the error "<span class="Apple-style-span" style="font-size: 12px; ">ERROR [edu.internet2.middleware.shibboleth.common.config.BaseService:188] - Configuration was not loaded for shibboleth.AttributeFilterEngine service, error creating components. The root cause of this error was: org.xml.sax.SAXParseException: cvc-elt.4.3: Type 'basic:OR' is not validly derived from the type definition, 'AttributeRuleType', of element 'afp:AttributeRule'."</span></div><div><span class="Apple-style-span" style="font-size: 12px; "><br></span></div><div><span class="Apple-style-span" style="font-size: 12px; ">I had a look at the schema and I don't think it allows for an OR on an AttributeRule.</span></div><div><span class="Apple-style-span" style="font-size: 12px; "><br></span></div><div><span class="Apple-style-span" style="font-size: 12px; ">Anybody got a suggestion that doesn't involve a script resolver, or a </span><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirementScript">script matching rule </a>?</div><div>Glenn</div><div><br></div><div apple-content-edited="true">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div><a href="http://www.edugate.ie">Edugate</a> Operations</div><div><a href="http://www.heanet.ie">HEAnet Limited</a>, Ireland's Education and Research Network - </div><div>1st Floor, 5 George's Dock, IFSC, Dublin 1</div><div>Registered in Ireland, no 275301 tel: +353-1-6609040 fax: +353-1-6603666</div></div></div>
</div>
<br></body></html>