<div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Thank you...it gave me confidence.This is beyond my realm of familiarity. Sincere apologies for the newbie configuration questions.<br></div><div><br></div><div>I have been experimenting, and came up with following. There were no syntax errors, which were initial battles, but the condition appears to allow all accounts through even if having none of the pattern/value (I made sure there is the p:postAuthenticationFlows correctly set). Could anyone point me where I could have gone wrong? Thank you.<br></div><div><br></div><div><bean id="ContextCheckPredicate" parent="shibboleth.Conditions.OR"><br>        <constructor-arg><br>             <list><br>                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidate="<a href="http://sp.example.edu">sp.example.edu</a>" /><br>                 <bean class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"<br>                         p:useUnfilteredAttributes="true"<br>                         p:attributeId="groupMembership"<br>                         p:pattern="^(.*?)ou=employee,dc=example,dc=edu" /><br>                 <bean class="net.shibboleth.idp.profile.logic.RegexAttributePredicate"<br>                         p:useUnfilteredAttributes="true"<br>                         p:attributeId="groupMembership"<br>                         p:pattern="^(.*?)ou=staff,dc=example,dc=edu" /><br>                 <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"<br>                         p:useUnfilteredAttributes="true"<br>                         <property name="attributeValueMap"><br>                         <map><br>                            <entry key="eduPersonAffiliation"><br>                                <list><br>                                    <value>student</value><br>                                </list><br>                            </entry><br>                         </map><br>                    </property><br>                         </bean><br>             </list><br>        </constructor-arg> <br>    </bean><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Dec 10, 2018 at 6:11 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 12/9/18, 2:24 PM, "users on behalf of Nanda Cairns" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:amanada.cairns@gmail.com" target="_blank">amanada.cairns@gmail.com</a>> wrote:<br>
<br>
> I have a condition where I have to check OR on 2 different groups and 1 attribute value (only allow access if user is at<br>
> least in one of these):<br>
<br>
Then do all three wrapped in an shibboleth.Conditions.OR bean.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>