Overview
The Value
(basic:AttributeValueString
prior to V3.2) type compares attributes values against the supplied string.
Confusingly,
this type can be a Matcher or a PolicyRule.
- If no
attributeID
attribute is specified then it is a Matcher (returning that value if it is present amongst the values, and the empty set otherwise) - If an
attributeID
attribute is specified then it is a PolicyRule (returning true if that that is present amongst the values for the specified attribute).
Schema Name
The Value
type is defined in the urn:mace:shibboleth:2.0:afp
namespace, the schema for which can be located at http://shibboleth.net/schema/idp/shibboleth-afp.xsd
The deprecated basic:AttributeValueString
type is defined in the urn:mace:shibboleth:2.0:afp:mf:basic
namespace, the schema for which can be located at http://shibboleth.net/schema/idp/shibboleth-afp-mf-basic.xsd
Attributes
Three attributes may be specified
Name | Type | Default | Description |
---|---|---|---|
attributeID | String | none | If this is present, then this is a PolicyRule returning true if the matching attribute contains the supplied value. If this is not present, then this is a Matcher returning that value if it is present amongst the values, and the empty set otherwise. |
value | String | required | The value to match against |
ignoreCase | Boolean | false | Whether the matching is case insensitive |
Child Elements
None
Examples
<PolicyRequirementRule xsi:type="Value" value="jsmith" attributeID="uid"/>
Apply this rule if the attribute "uid" contains a value "jsmith"
<AttributeRule attributeID="uid"> <PermitValueRule xsi:type="Value" value="jsmith" ignoreCase="true" /> </AttributeRule>
If the attribute "uid" contains the value "jsmith" then add "jsmith to the permitted values to be release for "uid"
<PolicyRequirementRule xsi:type="Value" value="jsmith"/>
Apply this rule if any attribute contains a value "jsmith"
<AttributeRule attributeID="email"> <PermitValueRule xsi:type="Value" value="jsmith" ignoreCase="true" attributeID="uid"/> </AttributeRule>
If the attribute "uid" contains the value "jsmith" then release all values of "email" .