<div dir="ltr">PolicyRequirementRule for indicating filter poicies to which entities;<div><br></div><div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""> </span><span class=""><PolicyRequirementRule </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"basic:AttributeRequesterString"</span><span class=""> </span><span class="">value</span><span class="">=</span><span class="">"<a href="https://service.source.com">https://service.source.com</a>"</span><span class=""> /><br></span></blockquote><div> </div><div> OR is useful to include more than one requestor, but AND makes little sense</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""></span><span class=""> </span><span class=""><PolicyRequirementRule </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"basic:OR"</span><span class="">><br></span><span class=""> </span><span class=""><</span><span class="">basic</span><span class="">:</span><span class="">Rule </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"basic:AttributeRequesterString"</span><span class=""> </span><span class="">value</span><span class="">=</span><span class="">"<a href="http://instance.service.com">instance.service.com</a>"</span><span class=""> /><br></span><span class=""> </span><span class=""><</span><span class="">basic</span><span class="">:</span><span class="">Rule </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"basic:AttributeRequesterString"</span><span class=""> </span><span class="">value</span><span class="">=</span><span class="">"<a href="http://another.instance.com">another.instance.com</a>"</span><span class=""> /><br></span><span class=""> </span><span class=""></PolicyRequirementRule></span><br></blockquote><p class="">
</p><div>AttributeRule for conditions for specific attributes</div><div><br></div><div><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 30, 2016 at 11:06 AM, Michael Richter <span dir="ltr"><<a href="mailto:mrichter@coastal.edu" target="_blank">mrichter@coastal.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">So something more like this:<br>
<br>
<PolicyRequirementRule xsi:type="AND"><br>
<Rule xsi:type="Requester" value="<a href="https://e5.onthehub.com" rel="noreferrer" target="_blank">https://e5.onthehub.com</a>" /><br>
<Rule xsi:type="AttributeValueString" attributeID="isMemberOf" value="CN=Staff,OU=Groups,DC=coastal"/><br>
</PolicyRequirementRule><br>
<br>
<br>
When I try to start the IDP I get:<br>
Cannot resolve 'AttributeValueString' to a type definition for element 'Rule'<br>
<br>
<br>
Can I not use this xsi:type in PolicyRequirementRules?<br>
<br>
Thanks!<br>
<br>
When I try this I get<br>
<span class="im HOEnZb">-----Original Message-----<br>
From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] On Behalf Of Cantor, Scott<br>
</span><span class="im HOEnZb">Sent: Wednesday, March 30, 2016 2:17 PM<br>
To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
Subject: Re: Using isMemberof Attribute to release specific group membership<br>
<br>
</span><div class="HOEnZb"><div class="h5">On 3/30/16, 2:04 PM, "users on behalf of Michael Richter" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:mrichter@coastal.edu">mrichter@coastal.edu</a>> wrote:<br>
<br>
<br>
<br>
>Thanks for the tips so far. I think I'm on the right track, but need a little assist.<br>
>In the attribute rule below It's checking for memberships in Staff and CSCI.<br>
<br>
No, I don't know what that's doing. I think you're telling it to release a value only if it matches both of those values, which is completely impossible.<br>
<br>
The logic you're trying to build belongs in the PolicyRequirement. The thing that tells it when to apply the attribute rules in the policy.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>