<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)">Michael,</div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)">This sounds like a situation we had with a vendor, and we managed it without scripting. In our case, the vendor did not want to see any value of ePSA other than "student@..."; in your case, it sounds like your vendor doesn't want to see anything but "member@...". Here is the stanza I used in attribute-filter.xml.</div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><br></div><div class="gmail_default"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <AttributeFilterPolicy id="release_student_ePSA"></font></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <!-- I use an "OR" rule to make it easier for</font></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default"><font color="#000000" face="monospace, monospace"> someone to add another vendor in the future. --></font></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <PolicyRequirementRule xsi:type="OR"></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <Rule xsi:type="Requester" value="<vendor's entityID>" /></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> </PolicyRequirementRule></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"><br></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <!-- Make sure we are permitting the value we want. Not necessary</font><span style="color:rgb(0,0,0);font-family:monospace,monospace"> </span></div><div class="gmail_default"><span style="color:rgb(0,0,0);font-family:monospace,monospace"> if ePSA is </span><span style="color:rgb(0,0,0);font-family:monospace,monospace">already part of a bundle that applies to the SP. --></span></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <AttributeRule attributeID="eduPersonScopedAffiliation"></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <PermitValueRule xsi:type="ANY" /></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> </AttributeRule></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"><br></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <!-- Now deny all non-student values. --></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <AttributeRule attributeID="eduPersonScopedAffiliation"></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <DenyValueRule xsi:type="NOT"></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> <Rule xsi:type="Value" value="student" ignoreCase="true" /></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> </DenyValueRule></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> </AttributeRule></font></div><div class="gmail_default"><font color="#000000" face="monospace, monospace"> </AttributeFilterPolicy></font></div></div></blockquote><font color="#000000" face="tahoma, sans-serif"><br></font></div><div class="gmail_default"><font color="#000000" face="tahoma, sans-serif">Good luck! -Les</font></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><br><hr style="color:rgb(0,0,0);font-family:'times new roman','new york',times,serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:'times new roman','new york',times,serif;font-size:16px;text-align:right"><span size="2" style="color:rgb(153,102,51);font-size:small">Les LaCroix '79 </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> </span><span size="2" style="color:rgb(153,102,51);font-size:small">Strategic Technologist<br></span><span size="2" style="color:rgb(153,102,51);font-size:small">Carleton College </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> 1 N. College St. </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> MS 3-ITS </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> Northfield, MN 55057<br></span><span size="2" style="color:rgb(153,102,51);font-size:small">507.222.5455 | <a href="https://calendar.google.com/calendar/embed?src=llacroix%40carleton.edu&ctz=America/Chicago" target="_blank">free/busy</a></span></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Jan 3, 2018 at 12:05 PM, Michael Dahlberg <span dir="ltr"><<a href="mailto:olgamirth@gmail.com" target="_blank">olgamirth@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I have a problem with the requested values for eduPersonAffiliation with two of the SPs that I work with: one wants the value 'member' in place of the values 'student', 'staff', 'faculty', and 'employee'; and one wants the actual values. <div><br></div><div>I've read <a href="https://www.internet2.edu/media/medialibrary/2013/09/04/internet2-mace-dir-eduperson-201203.html#eduPersonAffiliation" target="_blank">https://www.internet2.edu/<wbr>media/medialibrary/2013/09/04/<wbr>internet2-mace-dir-eduperson-<wbr>201203.html#<wbr>eduPersonAffiliation</a> and it looks like ePA is a multi-valued attribute so it should be permissible for the ePA to have the value 'member' and 'student'. I was thinking that could be done with a scripted attribute. With that in mind, I have three questions:</div><div><br></div><div>(1) I've looked for some documentation on the scripting engine within the IdP and there does not look like there is much. Other than that found in <a href="https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition" target="_blank">https://wiki.shibboleth.<wbr>net/confluence/display/IDP30/<wbr>ScriptedAttributeDefinition</a>, would you be able to point me in the direction of some examples/descriptions of the functions?</div><div><br></div><div>(2) From the examples in the default attribute-resolver.xml file, it looks like the add("") function overwrites the existing values. Does the addValues("") function append a value to the existing value?</div><div><br></div><div>(3) If ePA is multi-valued, what would the resulting attributes be for eduPersonScopedAffiliation: (student,<a href="mailto:member@example.edu" target="_blank">member@example.edu</a>) or (<a href="mailto:student@example.edu" target="_blank">student@example.edu</a>,<a href="mailto:member@example.edu" target="_blank">member@<wbr>example.edu</a>)?</div><div><br></div><div>Thanks for the assistance.</div><div><br></div><div>Mike</div></div>
<br>--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>