<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.im
{mso-style-name:im;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Ok, I’m on my way. I’m using the PolicyRequriementRule to require the requester and that the memberof attribute contain the group needed. Now to finish, I’ll need to set up another AttributeFilter Policy which is fine, but is it possible to use both ANDs and NOT in A PolicyRequirementRule? I’d like to specify that a user be a member of the Faculty, but not a member of the Comp Sci group. I can see how to set the rules individually, but not in combination. Thanks!<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Mike<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'> <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> users [mailto:users-bounces@shibboleth.net] <b>On Behalf Of </b>IAM David Bantz<br><b>Sent:</b> Wednesday, March 30, 2016 3:17 PM<br><b>To:</b> Shib Users <users@shibboleth.net><br><b>Subject:</b> Re: Using isMemberof Attribute to release specific group membership<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>PolicyRequirementRule for indicating filter poicies to which entities;<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal> <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="https://service.source.com">https://service.source.com</a>" /><o:p></o:p></p></blockquote><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal> OR is useful to include more than one requestor, but AND makes little sense<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal> <PolicyRequirementRule xsi:type="basic:OR"><br> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="http://instance.service.com">instance.service.com</a>" /><br> <basic:Rule xsi:type="basic:AttributeRequesterString" value="<a href="http://another.instance.com">another.instance.com</a>" /><br> </PolicyRequirementRule><o:p></o:p></p></blockquote><div><p class=MsoNormal>AttributeRule for conditions for specific attributes<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Wed, Mar 30, 2016 at 11:06 AM, Michael Richter <<a href="mailto:mrichter@coastal.edu" target="_blank">mrichter@coastal.edu</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal style='margin-bottom:12.0pt'>So something more like this:<br><br><PolicyRequirementRule xsi:type="AND"><br> <Rule xsi:type="Requester" value="<a href="https://e5.onthehub.com" target="_blank">https://e5.onthehub.com</a>" /><br> <Rule xsi:type="AttributeValueString" attributeID="isMemberOf" value="CN=Staff,OU=Groups,DC=coastal"/><br> </PolicyRequirementRule><br><br><br>When I try to start the IDP I get:<br>Cannot resolve 'AttributeValueString' to a type definition for element 'Rule'<br><br><br>Can I not use this xsi:type in PolicyRequirementRules?<br><br>Thanks!<br><br>When I try this I get<br><span class=im>-----Original Message-----</span><br><span class=im>From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] On Behalf Of Cantor, Scott</span><br><span class=im>Sent: Wednesday, March 30, 2016 2:17 PM</span><br><span class=im>To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>></span><br><span class=im>Subject: Re: Using isMemberof Attribute to release specific group membership</span><o:p></o:p></p><div><div><p class=MsoNormal>On 3/30/16, 2:04 PM, "users on behalf of Michael Richter" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:mrichter@coastal.edu">mrichter@coastal.edu</a>> wrote:<br><br><br><br>>Thanks for the tips so far. I think I'm on the right track, but need a little assist.<br>>In the attribute rule below It's checking for memberships in Staff and CSCI.<br><br>No, I don't know what that's doing. I think you're telling it to release a value only if it matches both of those values, which is completely impossible.<br><br>The logic you're trying to build belongs in the PolicyRequirement. The thing that tells it when to apply the attribute rules in the policy.<br><br>-- Scott<br><br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><o:p></o:p></p></div></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>