<div dir="ltr">I've been reading <a href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions</a> <br><div><br></div><div>I understand, me thinks, how to set ContextCheckPredicate for AND/OR if within a group or attribute value.</div><div><br></div><div>I have a condition where I have to check OR on 2 different groups and 1 attribute value (only allow access if user is at least in one of these):</div><div><br></div><div><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Monaco;color:rgb(63,95,191)"><span style="color:rgb(42,0,255)">groupMembership</span><span class="gmail-s1" style="color:rgb(0,0,0)"> </span><span class="gmail-s4" style="color:rgb(127,0,127)">regex</span><span class="gmail-s1" style="color:rgb(0,0,0)">=</span><span style="color:rgb(42,0,255)">"^(.*?)ou=employee,dc=example,dc=edu</span><span class="gmail-s2" style="color:rgb(0,128,128)">/></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Monaco;color:rgb(63,95,191)"><span class="gmail-s2" style="color:rgb(0,128,128)"><span style="color:rgb(42,0,255)">groupMembership"</span><span class="gmail-s1" style="color:rgb(0,0,0)"> </span><span class="gmail-s4" style="color:rgb(127,0,127)">regex</span><span class="gmail-s1" style="color:rgb(0,0,0)">=</span><span style="color:rgb(42,0,255)">"^(.*?)</span><span style="color:rgb(42,0,255)">ou=staff,dc=example,dc=edu</span><span style="color:rgb(42,0,255)">"</span><span class="gmail-s2">/></span><br></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Monaco;color:rgb(63,95,191)"><span class="gmail-s2" style="color:rgb(0,128,128)"><span class="gmail-s2"><span style="color:rgb(42,0,255)">"Value"</span><span class="gmail-s1" style="color:rgb(0,0,0)"> </span><span class="gmail-s4" style="color:rgb(127,0,127)">attributeID</span><span class="gmail-s1" style="color:rgb(0,0,0)">=</span><span style="color:rgb(42,0,255)">"eduPersonAffiliation"</span><span class="gmail-s1" style="color:rgb(0,0,0)"> </span><span class="gmail-s4" style="color:rgb(127,0,127)">value</span><span class="gmail-s1" style="color:rgb(0,0,0)">=</span><span style="color:rgb(42,0,255)">"student"</span><br></span></span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;font-size:11px;line-height:normal;font-family:Monaco;color:rgb(63,95,191)"><br></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal">Searching<span style="color:rgb(34,34,34);font-family:Arial,Helvetica,sans-serif;font-size:small"> online, revealed previously similar questions: </span></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><a href="http://shibboleth.1660669.n2.nabble.com/SP-Authorization-via-ContextCheckPredicate-td7634075.html">http://shibboleth.1660669.n2.nabble.com/SP-Authorization-via-ContextCheckPredicate-td7634075.html</a><br></p><p class="gmail-p1" style="margin:0px;font-variant-numeric:normal;font-variant-east-asian:normal;font-stretch:normal;line-height:normal"><a href="http://shibboleth.1660669.n2.nabble.com/Handling-New-User-Memberships-td7633038.html">http://shibboleth.1660669.n2.nabble.com/Handling-New-User-Memberships-td7633038.html</a><br></p></div><div><br></div><div>Similar to poster above, I could create the flag in attribute-resolver.xml based on the logic -- however, was trying to find if can find alternative. </div><div><br></div><div>Sample which works for single groupMembership is below --- being frank, upon reading the javadocs and remaining befuddled, how could this be expanded to 2 regex on groupMembership and 1 attribute value:</div><div><br></div><div><p class="gmail-p1" style="font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px;color:rgb(42,0,255)"><span class="gmail-s1" style="color:rgb(0,128,128)"><</span><span class="gmail-s2" style="color:rgb(63,127,127)">bean</span><span class="gmail-s3" style="color:rgb(0,0,0)"><span> </span></span><span class="gmail-s4" style="color:rgb(127,0,127)">id</span><span class="gmail-s3" style="color:rgb(0,0,0)">=</span>"ContextCheckPredicate"<span class="gmail-s3" style="color:rgb(0,0,0)"><span> </span></span><span class="gmail-s4" style="color:rgb(127,0,127)">parent</span><span class="gmail-s3" style="color:rgb(0,0,0)">=</span>"shibboleth.Conditions.AND"<span class="gmail-s1" style="color:rgb(0,128,128)">></span></p><p class="gmail-p2" style="font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px;color:rgb(63,127,127)"><span class="gmail-s3" style="color:rgb(0,0,0)"><span class="gmail-Apple-converted-space">       <span> </span></span></span><span class="gmail-s1" style="color:rgb(0,128,128)"><</span>constructor-arg<span class="gmail-s1" style="color:rgb(0,128,128)">></span></p><p class="gmail-p3" style="color:rgb(34,34,34);font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px"><span class="gmail-Apple-converted-space">            <span> </span></span><span class="gmail-s1" style="color:rgb(0,128,128)"><</span><span class="gmail-s2" style="color:rgb(63,127,127)">list</span><span class="gmail-s1" style="color:rgb(0,128,128)">></span></p><p class="gmail-p1" style="font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px;color:rgb(42,0,255)"><span class="gmail-s3" style="color:rgb(0,0,0)"><span class="gmail-Apple-converted-space">                <span> </span></span></span><span class="gmail-s1" style="color:rgb(0,128,128)"><</span><span class="gmail-s2" style="color:rgb(63,127,127)">bean</span><span class="gmail-s3" style="color:rgb(0,0,0)"><span> </span></span><span class="gmail-s4" style="color:rgb(127,0,127)">parent</span><span class="gmail-s3" style="color:rgb(0,0,0)">=</span>"shibboleth.Conditions.RelyingPartyId"<span class="gmail-s3" style="color:rgb(0,0,0)"><span> </span></span><span class="gmail-s4" style="color:rgb(127,0,127)">c:candidate</span><span class="gmail-s3" style="color:rgb(0,0,0)">=</span>"<a href="http://sp.example.edu">sp.example.edu</a>"<span class="gmail-s3" style="color:rgb(0,0,0)"><span> </span></span><span class="gmail-s1" style="color:rgb(0,128,128)">/></span></p><p class="gmail-p1" style="font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px;color:rgb(42,0,255)"><span class="gmail-s3" style="color:rgb(0,0,0)"><span class="gmail-Apple-converted-space">                <span> </span></span></span><span class="gmail-s1" style="color:rgb(0,128,128)"><</span><span class="gmail-s2" style="color:rgb(63,127,127)">bean</span><span class="gmail-s3" style="color:rgb(0,0,0)"><span> </span></span><span class="gmail-s4" style="color:rgb(127,0,127)">class</span><span class="gmail-s3" style="color:rgb(0,0,0)">=</span>"net.shibboleth.idp.profile.logic.RegexAttributePredicate"</p><p class="gmail-p3" style="color:rgb(34,34,34);font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px"><span class="gmail-Apple-converted-space">                        <span> </span></span><span class="gmail-s4" style="color:rgb(127,0,127)">p:useUnfilteredAttributes</span>=<span class="gmail-s5" style="color:rgb(42,0,255)">"true"</span></p><p class="gmail-p3" style="color:rgb(34,34,34);font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px"><span class="gmail-Apple-converted-space">                        <span> </span></span><span class="gmail-s4" style="color:rgb(127,0,127)">p:attributeId</span>=<span class="gmail-s5" style="color:rgb(42,0,255)">"groupMembership"</span></p><p class="gmail-p1" style="font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px;color:rgb(42,0,255)"><span class="gmail-s3" style="color:rgb(0,0,0)"><span class="gmail-Apple-converted-space">                        <span> </span></span></span><span class="gmail-s4" style="color:rgb(127,0,127)">p:pattern</span><span class="gmail-s3" style="color:rgb(0,0,0)">=</span>"^(.*?)ou=foo,dc=example,dc=edu"<span class="gmail-s3" style="color:rgb(0,0,0)"><span> </span></span><span class="gmail-s1" style="color:rgb(0,128,128)">/></span></p><p class="gmail-p3" style="color:rgb(34,34,34);font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px"><span class="gmail-Apple-converted-space">            <span> </span></span><span class="gmail-s1" style="color:rgb(0,128,128)"></</span><span class="gmail-s2" style="color:rgb(63,127,127)">list</span><span class="gmail-s1" style="color:rgb(0,128,128)">></span></p><p class="gmail-p2" style="font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px;color:rgb(63,127,127)"><span class="gmail-s3" style="color:rgb(0,0,0)"><span class="gmail-Apple-tab-span" style="white-space:pre">      </span><span class="gmail-Apple-tab-span" style="white-space:pre">      </span></span><span class="gmail-s1" style="color:rgb(0,128,128)"></</span>constructor-arg<span class="gmail-s1" style="color:rgb(0,128,128)">></span><span class="gmail-s3" style="color:rgb(0,0,0)"><span class="gmail-Apple-converted-space"> </span></span></p><p class="gmail-p3" style="color:rgb(34,34,34);font:400 11px Monaco;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px"><span class="gmail-Apple-converted-space">   <span> </span></span><span class="gmail-s1" style="color:rgb(0,128,128)"></</span><span class="gmail-s2" style="color:rgb(63,127,127)">bean</span><span class="gmail-s1" style="color:rgb(0,128,128)">></span></p><br class="gmail-Apple-interchange-newline"></div></div>