<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Joshua,</p>
<p>here is an example from my idp combining multiple conditions:</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"login-proceed"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.Conditions.OR"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ref</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">bean</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-is-local"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ref</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">bean</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-allow-functional-user"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.Conditions.NOT"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ref</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">bean</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"user-is-functional"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div></div>
</blockquote>
</p>
<p>You just have to add '<span style="color: #808080;"><</span><span
style="color: #569cd6;">bean</span><span style="color: #d4d4d4;">
</span><span style="color: #9cdcfe;">parent</span><span
style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.Conditions.OR"</span><span
style="color: #808080;">></span>' after your RelyingPartyId
condition and then you can add mutliple SimpleAttributePredicates.</p>
<p>With nice regards.</p>
<p>Martin<br>
</p>
<div class="moz-cite-prefix">Am 09.04.19 um 21:49 schrieb Joshua
Brodie:<br>
</div>
<blockquote type="cite"
cite="mid:CAO-t1wHYVMu0B64X3SDkXt5SYhumhpY-1iH9ghmqnVfZDFZ7aw@mail.gmail.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div dir="ltr">Hi List.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">This has been stumping me, and wondering if any
can guide me through my mental fog.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">We have the following condition to allow access
to an SP -- the IdP intercepts is condition is not met and
present a message to say access denied.</div>
<div dir="ltr"><br>
</div>
<div>How do I add an additional 'OR' condition for
groupMembership? I.e. allow access if in eduPersonAffiliation
(with values in list below) OR if member in a groupMembership?</div>
<div><br>
</div>
<div dir="ltr">
<div><br>
</div>
<div>
<div><bean id="ContextCheckPredicate"
parent="shibboleth.Conditions.AND"></div>
<div> <constructor-arg></div>
<div> <list></div>
<div> <bean
parent="shibboleth.Conditions.RelyingPartyId"
c:candidates="#{{'<a href="http://www.sp.example.com/sp'}"
moz-do-not-send="true">http://www.sp.example.com/sp'}</a>}"
/></div>
<div> <bean
class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"</div>
<div>
p:useUnfilteredAttributes="true"></div>
<div> <property
name="attributeValueMap"></div>
<div> <map></div>
<div> <entry
key="eduPersonAffiliation"></div>
<div> <list></div>
<div>
<value>faculty</value></div>
<div>
<value>staff</value></div>
<div>
<value>guest</value></div>
<div> </list></div>
<div> </entry></div>
<div> </map></div>
<div> </property></div>
<div> </bean></div>
<div> </list></div>
<div><span style="white-space:pre"> </span></constructor-arg> </div>
<div> </bean></div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
<pre class="moz-signature" cols="72">--
Martin Lunze
IT-Systemadministrator
Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden
Tel.: +49 (351) 463-35881
E-Mail: <a class="moz-txt-link-abbreviated" href="mailto:martin.lunze@tu-dresden.de">martin.lunze@tu-dresden.de</a></pre>
</body>
</html>