<div dir="ltr"><div dir="ltr">Hi List.</div><div dir="ltr"><br></div><div dir="ltr">This has been stumping me, and wondering if any can guide me through my mental fog.</div><div dir="ltr"><br></div><div dir="ltr">We have the following condition to allow access to an SP -- the IdP intercepts is condition is not met and present a message to say access denied.</div><div dir="ltr"><br></div><div>How do I add an additional 'OR' condition for groupMembership? I.e. allow access if in eduPersonAffiliation (with values in list below) OR if member in a groupMembership?</div><div><br></div><div dir="ltr"><div><br></div><div><div><bean id="ContextCheckPredicate" parent="shibboleth.Conditions.AND"></div><div>        <constructor-arg></div><div>             <list></div><div>                 <bean parent="shibboleth.Conditions.RelyingPartyId" c:candidates="#{{'<a href="http://www.sp.example.com/sp'}">http://www.sp.example.com/sp'}</a>}" /></div><div>                 <bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"</div><div>                         p:useUnfilteredAttributes="true"></div><div>                          <property name="attributeValueMap"></div><div>                        <map></div><div>                            <entry key="eduPersonAffiliation"></div><div>                                <list></div><div>                                    <value>faculty</value></div><div>                                    <value>staff</value></div><div>                                    <value>guest</value></div><div>                                </list></div><div>                            </entry></div><div>                        </map></div><div>                    </property></div><div>                    </bean></div><div>             </list></div><div><span style="white-space:pre">             </span></constructor-arg> </div><div>    </bean></div></div></div></div>