<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Courier New" size="3"><span style="font-size:12pt;">
<div>I'm try to setup an attribute-filter entry to allow authentication if a user is a member of a given group in AD. The concept below is to only allow CompSci majors and minors access to a site.</div>
<div> </div>
<div> </div>
<div>Attribute-filter.xml</div>
<div> </div>
<div><afp:PolicyRequirementRule xsi:type="basic:AND"></div>
<div> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="https://fm.incommon.org/sp">https://fm.incommon.org/sp</a>" /></div>
<div> <PermitValueRule xsi:type="basic:OR"></div>
<div> <basic:Rule xsi:type="basic:AttributeValueString" attributeID="isMemberOf" value="COMPSCI-MAJ" ignoreCase="true"/></div>
<div> <basic:Rule xsi:type="basic:AttributeValueString" attributeID="isMemberOf" value="COMPSCI-MIN" ignoreCase="true"/></div>
<div> </PermitValueRule></div>
<div></afp:PolicyRequirementRule></div>
<div> </div>
<div> </div>
<div>isMemberOf from our attribute-resolver.xml</div>
<div> </div>
<div> </div>
<div><resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="isMemberOf"></div>
<div> <resolver:Dependency ref="myLDAP" /></div>
<div> <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf" /></div>
<div></resolver:AttributeDefinition></div>
<div> </div>
<div> </div>
<div>The issue with mixing the basic rule with the PermitValueRule, any ideas?</div>
<div> </div>
<div> </div>
<div>Thanks,</div>
<div> </div>
<div> </div>
<div>~Patrick</div>
<div> </div>
</span></font>
</body>
</html>