<div dir="ltr">
<p class="gmail-p1">We have an application whereby only authorized if user has either a particular eduPersonEntitlement (<a href="https://example.edu/employee/active">https://example.edu/employee/active</a>) OR memberOf (cn=adhoc,ou=example,ou=edu).</p><p class="gmail-p1">Have I followed good practice with 'shibboleth.context-check.Condition' as shown below -- I haven't been able to test if it works and suspense if this is correct (test ldap down).</p><p class="gmail-p1"><br></p><p class="gmail-p1"><span class="gmail-s1"><</span><span class="gmail-s2">bean</span><span class="gmail-s3"> </span><span class="gmail-s4">id</span><span class="gmail-s3">=</span>"shibboleth.context-check.Condition"<span class="gmail-s3"> </span><span class="gmail-s4">parent</span><span class="gmail-s3">=</span>"shibboleth.Conditions.OR"<span class="gmail-s1">></span></p><p class="gmail-p2"><span class="gmail-s3"> </span><span class="gmail-s1"><</span>constructor-arg<span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">list</span><span class="gmail-s1">></span></p><p class="gmail-p1"><span class="gmail-s3"> </span><span class="gmail-s1"><</span><span class="gmail-s2">bean</span><span class="gmail-s3"> </span><span class="gmail-s4">parent</span><span class="gmail-s3">=</span>"shibboleth.Conditions.RelyingPartyId"<span class="gmail-s3"> </span><span class="gmail-s4">c:candidates</span><span class="gmail-s3">=</span>"#{ '<a href="https://sp.example.org">https://sp.example.org</a>' }"<span class="gmail-s3"> </span><span class="gmail-s1">/></span></p><p class="gmail-p1"><span class="gmail-s3"> </span><span class="gmail-s1"><</span><span class="gmail-s2">bean</span><span class="gmail-s3"> </span><span class="gmail-s4">class</span><span class="gmail-s3">=</span>"net.shibboleth.idp.profile.logic.SimpleAttributePredicate"</p><p class="gmail-p3"> <span class="gmail-s4">p:useUnfilteredAttributes</span>=<span class="gmail-s5">"true"</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">property</span> <span class="gmail-s4">name</span>=<span class="gmail-s5">"attributeValueMap"</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">map</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">entry</span> <span class="gmail-s4">key</span>=<span class="gmail-s5">"eduPersonEntitlement"</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">list</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">value</span><span class="gmail-s1">><a href="https://example.edu/employee/active">https://example.edu/employee/active</a></span><span class="gmail-s1"></</span><span class="gmail-s2">value</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">list</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">entry</span><span class="gmail-s1">></span></p><p class="gmail-p3"><span class="gmail-s1"> <</span><span class="gmail-s2">entry</span> <span class="gmail-s4">key</span>=<span class="gmail-s5">"memberOf"</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">list</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"><</span><span class="gmail-s2">value</span><span class="gmail-s1">>cn=adhoc,ou=example,ou=edu</span><span class="gmail-s1"></</span><span class="gmail-s2">value</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">list</span><span class="gmail-s1">></span></p><p class="gmail-p3"><span class="gmail-s1"></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">entry</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">map</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">property</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">bean</span><span class="gmail-s1">></span></p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">list</span><span class="gmail-s1">></span></p><p class="gmail-p2"><span class="gmail-s3"> </span><span class="gmail-s1"></</span>constructor-arg<span class="gmail-s1">></span></p><p class="gmail-p1">
</p><p class="gmail-p3"> <span class="gmail-s1"></</span><span class="gmail-s2">bean</span><span class="gmail-s1">></span></p></div>