<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal style='background:white'><span style='font-size:10.0pt;font-family:"Verdana",sans-serif;color:black'>Hello all,<span class=apple-converted-space> </span><br> I'm trying to do something that should be (and may be) easy. I'm still new to Shibboleth and may be missing something, but I've spent the last day trying to figure this out. <span class=apple-converted-space> </span><br><br>I need to release a group membership based on specific criteria. Basically we have a site that has 3 levels of access, CompSci, Faculty, Staff (from highest privileged to least). I'd like to release the group membership that matches the highest privilege the user is entitled to. Below is where I am<span class=apple-converted-space> </span><br><br>I have my attribute resolver populating the isMemberOf attribute with a list of all groups the user is a member of. Then in my attribute-filter.xml I use the following rule to release the group name.<span class=apple-converted-space> </span><br><br><AttributeRule attributeID="isMemberOf"><br> <PermitValueRule xsi:type="Value" value="CN=Staff,OU=Groups,DC=coastal,DC=edu"/><br></AttributeRule><br><br>This sends the single group membership. This would work if I was looking for a single group, but I need to prioritize. Is it possible in the Attribute filter to set a rule to try to match the "CompSci" group first and then stop if it is found, but if it is not found then move on to the next rule that will try to match the "Faculty" group and send it if found. This would allow me to only send the group that has highest level of privileges allowed to the user.<span class=apple-converted-space> </span><br><br>Any help would be appreciated. Thanks!<span class=apple-converted-space> </span><br><br>Mike Richter<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Mike Richter<o:p></o:p></p><p class=MsoNormal>ITS System Administrator<o:p></o:p></p><p class=MsoNormal>Coastal Carolina University<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>