<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Courier New" size="3"><span style="font-size:12pt;">
<div>I'm try to setup an attribute-filter entry to allow authentication if a user is a member of a given group in AD. The concept below is to only allow CompSci majors and minors access to a site.</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>Attribute-filter.xml</div>
<div>&nbsp;</div>
<div>&lt;afp:PolicyRequirementRule xsi:type=&quot;basic:AND&quot;&gt;</div>
<div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;basic:Rule xsi:type=&quot;basic:AttributeRequesterString&quot; value=&quot;<a href="https://fm.incommon.org/sp">https://fm.incommon.org/sp</a>&quot; /&gt;</div>
<div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;PermitValueRule&nbsp; xsi:type=&quot;basic:OR&quot;&gt;</div>
<div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;basic:Rule xsi:type=&quot;basic:AttributeValueString&quot; attributeID=&quot;isMemberOf&quot; value=&quot;COMPSCI-MAJ&quot; ignoreCase=&quot;true&quot;/&gt;</div>
<div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;basic:Rule xsi:type=&quot;basic:AttributeValueString&quot; attributeID=&quot;isMemberOf&quot; value=&quot;COMPSCI-MIN&quot; ignoreCase=&quot;true&quot;/&gt;</div>
<div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/PermitValueRule&gt;</div>
<div>&lt;/afp:PolicyRequirementRule&gt;</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>isMemberOf from our attribute-resolver.xml</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>&lt;resolver:AttributeDefinition id=&quot;isMemberOf&quot; xsi:type=&quot;Simple&quot; xmlns=&quot;urn:mace:shibboleth:2.0:resolver:ad&quot; sourceAttributeID=&quot;isMemberOf&quot;&gt;</div>
<div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;resolver:Dependency ref=&quot;myLDAP&quot; /&gt;</div>
<div>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;resolver:AttributeEncoder xsi:type=&quot;SAML2String&quot; xmlns=&quot;urn:mace:shibboleth:2.0:attribute:encoder&quot; name=&quot;urn:oid:1.3.6.1.4.1.5923.1.5.1.1&quot; friendlyName=&quot;isMemberOf&quot; /&gt;</div>
<div>&lt;/resolver:AttributeDefinition&gt;</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>The issue with mixing the basic rule with the PermitValueRule, any ideas?</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>Thanks,</div>
<div>&nbsp;</div>
<div>&nbsp;</div>
<div>~Patrick</div>
<div>&nbsp;</div>
</span></font>
</body>
</html>