Overview
Each <afp:AttributeRule> An <AttributeRule> defines a filter operation to be applied to the values of one specified specific attribute.
Each rule is either a permit rule, in which case the filtered values are added to the permit list as described here or , or a deny rule, in which case the filtered attributes are added to the deny list as described.
Examples
| Code Block | ||
|---|---|---|
| ||
<AttributeRule attributeID="eduPersonPrincipalName">
<PermitValueRule xsi:type="Value" value="jsmith" ignoreCase="true" />
</AttributeRule> |
Reference
Schema Name
Elements and types described in this page and its children are defined by the (see here).
Schema Name and Location
The element itself is defined within the urn:mace:shibboleth:2.0:afp (afp:) schema, which can be located at http://shibboleth.net/schema/idp/shibboleth-afp.xsd.
In addition, IdP versions prior to 3.2.0 used the following schemas.
...
namespace, the schema for which can be located
...
at http://shibboleth.net/schema/idp/shibboleth-afp
...
...
Use of these schemas is still supported ifrom V3.2.0, but not required. Types defined in these two schemas, have corresponding types, with the same, or a truncated version of the name. The full tables of legacy to current mapping is given here.
The actual plugin types used are defined in namespaces specific to those types (though in practice they are now defined within the same namespace, or a pair of legacy namespaces in older versions, as described throughout this documentation).
Reference
Attributes
| Name | Type | Description |
|---|---|---|
attributeID | String | This required attributes specifies the |
| IdPAttribute name (as defined by |
an <AttributeDefinition> plugin in the AttributeResolverConfiguration). Note, this is the internal name of the IdPAttribute "private" to the IdP and not anything to do with the name of a formalized SAML Attribute. | ||
permitAny | Boolean | If this is present and |
set to "true", then there no child elements |
used, and is shorthand for: <AttributeRule attributeID="..."> <PermitValueRule xsi:type="ANY" /> |
Child Elements
...
| Name | Cardinality | Description |
|---|---|---|
<PermitValueRule> or <DenyValueRule> | 1 | The permit or deny rule to apply to the specified attribute's values. |
The child element must have a plugin xsi:type specified, usually one of the Common Types.This rule should be of a matcher type. If it is of PolicyRule type , generally a Matcher. If a PolicyRule plugin is used, then it will be converted as described here.
Examples
| Code Block | ||
|---|---|---|
| ||
<AttributeRule attributeID="eduPersonScopedAffiliation">
<PermitValueRule xsi:type="Value" value="student" ignoreCase="true" />
</AttributeRule> |