Page Comparison

...

Here's an example policy (more or less matching an example in the default file) that applies this tag test :

...

to a couple of attributes. A couple of subtle points here.

One is that this approach is really a purely "local" one because the IdP Attribute names are local/internal only. You might assume most people use similar conventions and you'd be right, but you can't expect that to be true universally, so it is not appropriate to ever try and use this kind of metadata tag outside of a scenario that does not involve control of the IdP. It's not a fix for the brokenness of the more general SAML <RequestedAttribute> metadata element, which is unusable for a variety of reasons.

Less critically, note that this policy example demonstrates an optimization in that it applies the tag check in the <AttributeRule>(s) and not up in the <PolicyRequirementRule>. This has the advantage of requiring less XML to express and is about the same or better in performance than running multiple policies. It's not as good for an attribute that might have 3-5 or more values, since that would force the cost of checking for the tag to be paid for each value.

<AttributeFilterPolicy id="Per-Attribute-singleValued">
	<PolicyRequirementRule xsi:type="ANY"/>

	<AttributeRule attributeID="eduPersonPrincipalName">
		<PermitValueRule xsi:type="EntityAttributeExactMatch"
			attributeName="http://macedir.org/entity-category"
                attributeValue="urn:mace:osu.edu:shibboleth:attribute-def:FERPA" />
        </PolicyRequirementRule>

        shibboleth.net/ns/attributes/releaseAllValues"
			attributeNamespace="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
			attributeValue="eduPersonPrincipalName" />
	</AttributeRule>

	<AttributeRule attributeID="eduPersonPrincipalName">
            mail">
		<PermitValueRule xsi:type="EntityAttributeExactMatch"
			attributeName="http://shibboleth.net/ns/attributes/releaseAllValues"
			attributeNamespace="urn:mace:osu.edu:shibboleth:attribute-release"
                attributeValue="eduPersonPrincipalNameoasis:names:tc:SAML:2.0:attrname-format:uri"
			attributeValue="mail" />
        	</AttributeRule>
	
</AttributeFilterPolicy>

Reference