<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
You should just setup a separate filter rule to DENY those attributes to that EntityID. Deny rules always trump Allow rules.<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Purcell, Brian K <purcell@uthscsa.edu><br>
<b>Sent:</b> Monday, February 14, 2022 5:49 PM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Subject:</b> Exclude specific EntityID from attribute-match policy requirement rule?</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Is there a way to exclude a specific EntityID from an attribute-match policy requirement rule in the attribute filter policy? Specifically, I'm trying to exclude one specific EntityID that matches on the following policy because I need
to do a custom EPPN for them that converts it to all upper case.<br>
<br>
<AttributeFilterPolicy id="FedServices"><br>
<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"<br>
attributeName="<a href=""></a>https://urldefense.com/v3/__https://federation.org/entity-category__;!!IBzWLUs!G_dE24OyYe9vpKK3njqU4YFeou7zR001ztZw0uRJ92xzWvN7SwwQ1ccFH1YT4A$ "<br>
attributeValue="<a href=""></a>https://urldefense.com/v3/__https://federation.org/category/FedServices__;!!IBzWLUs!G_dE24OyYe9vpKK3njqU4YFeou7zR001ztZw0uRJ92xzWvN7SwwQ1cd9Ay7m_A$ " /><br>
<AttributeRule attributeID="eduPersonPrincipalName"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule><br>
<AttributeRule attributeID="email"><br>
<PermitValueRule xsi:type="ANY" /><br>
</AttributeRule><br>
</AttributeFilterPolicy><br>
<br>
I tried adding a second filter policy for that EntityID that uses the custom upper case EPPN, but that causes two instances of EPPN to be in the SAML response with the lower case one coming first, and it looks like the application consumes the first one in
the response. So I tried moving that specific policy higher in attribute-filter.xml than the FedServices policy, but that didn't make any difference. I also tried to add a NOT rule to the FedServices policy to exclude that specific EntityID, but the policy
would not reload with that. It's quite possible I had the syntax wrong.<br>
<br>
The metadata for this SP is coming to us via federation metadata, so I'm not able to remove the attribute from the metadata.<br>
<br>
Thanks in advance for any suggestions.<br>
<br>
--Brian Purcell<br>
IT Systems Architect<br>
UT Health San Antonio<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!G_dE24OyYe9vpKK3njqU4YFeou7zR001ztZw0uRJ92xzWvN7SwwQ1cdI2FQfvA$">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!G_dE24OyYe9vpKK3njqU4YFeou7zR001ztZw0uRJ92xzWvN7SwwQ1cdI2FQfvA$</a>
<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>