<div dir="ltr">Adam,<div>We use the following nesting succesfully:<div><br></div><div><div><font size="1"><i><PolicyRequirementRule xsi:type="NOT"></i></font></div><div><font size="1"><i> <Rule xsi:type="OR"></i></font></div><div><font size="1"><i> <Rule xsi:type="Requester" value="SPID1" /></i></font></div><div><i style="font-size:x-small"> <Rule xsi:type="Requester" value="SPID2" /></i><font size="1"><i><br></i></font></div><div><i style="font-size:x-small"> <Rule xsi:type="Requester" value="SPID3" /></i></div><div><font size="1"><i> </Rule></i></font></div><div><font size="1"><i></PolicyRequirementRule></i></font></div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-family:Tahoma;font-size:13px">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma">
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1"><span></span></font>
<hr>
<font face="Arial" size="1"><span></span></font><b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">James Gross</span></b><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">
<span>| Enterprise Application and </span>CMS Developer</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'"> (Enterprise Web Services)<br>
</span>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">UNC Charlotte
<span>| </span>Information Technology Services</span></p>
<div style="font-size:13px;font-family:Tahoma"><font face="Arial" size="1">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">9201 University City Blvd.
<span>| </span>Charlotte, NC 28223</span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">Phone: 704-687-0298
<span>| Office: Kennedy 301-C39</span></span></p>
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="mailto:jgross15@uncc.edu" target="_blank">jgross15@uncc.edu</a>
</span><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">|
</span><span style="font-size:8pt;color:blue;font-family:'Arial','sans-serif'"><a href="http://www.uncc.edu" target="_blank">http://www.uncc.edu</a></span></p>
<span style="color:black;font-family:'Arial','sans-serif'"></span></font>
<hr>
<font face="Arial" size="1"><span style="color:black;font-family:'Arial','sans-serif'">
<p style="margin:0in 0in 0pt"><span style="font-size:8pt;color:black;font-family:'Arial','sans-serif'">If
you are not the intended recipient of this transmission or a person
responsible for delivering it to the intended recipient, any disclosure,
copying, distribution, or other use of any of the information in this
transmission is strictly prohibited. If you have received this
transmission in error, please notify me immediately by reply e-mail or
by telephone at 704-687-0298. Thank you.</span></p>
</span></font>
<p> </p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div></div></div></div></div>
<br><div class="gmail_quote">On Fri, Mar 31, 2017 at 11:36 AM, Adam Portier <span dir="ltr"><<a href="mailto:aportier@haverford.edu" target="_blank">aportier@haverford.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Good morning,<div><br></div><div>I am working on an integration with an external SP for our college. Under our current filter policy, we release the same set of attributes to all SPs *except* one, which doesn't handle unexpected attributes in the release well. It looks something like this right now:</div><div><br></div><div><div><AttributeFilterPolicy id="default"></div><div><br></div><div> <PolicyRequirementRule xsi:type="NOT"></div><div> <Rule xsi:type="Requester" value="<a href="http://problem-sp.com" target="_blank">problem-sp.com</a>" /></div><div> </PolicyRequirementRule></div><div>...</div><div><br></div><div>I the new SP I am working on integrating has very similar problems with unexpected attributes. Rather than changing the policy to explicitly list out every SP allowed to use it with an AND, I would like to extend the NOT to handle 2 SPs. Here is what I think should work, but is throwing an error in the logs.</div><div><div><br class="m_-4113756142969162968gmail-Apple-interchange-newline"><AttributeFilterPolicy id="default"></div><div><br></div><div> <PolicyRequirementRule xsi:type="NOT"></div><div> <Rule xsi:type="Requester" value="<a href="http://problem-sp.com" target="_blank">problem-sp.com</a>" /></div><div> <Rule xsi:type="Requester" value="<a href="http://problem-sp2.com" target="_blank">problem-sp2.com</a>" /><br></div><div> </PolicyRequirementRule></div><div>...</div></div><div><br></div><div>I have dug through the mailing list archives and could not find an answer to this problem. I have also reviewed the schema, and what I am doing should not be a violation (if I understand it correctly, which I likely do not). I have tried creating a nested set of PolicyRequirementRule blocks that either have multiple NOT rules inside an OR rule, or a NOT rule containing a single OR rule. Nothing has worked so far. If anyone has had success creating a filter policy that permits multiple NOT rules, I would appreciate some pointers.</div><div><br></div><div>Thank you.</div><span class="HOEnZb"><font color="#888888"><div><br></div>-- <br><div class="m_-4113756142969162968gmail_signature"><div dir="ltr">Adam Portier<br><div>Linux Administrator</div><div>IITS Core Technologies</div><div>Haverford College</div></div></div>
</font></span></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div></div>