View Source

Overview

The Value (basic:AttributeValueString prior to V3.2) type compares attributes values against the supplied string.

Confusingly, this type can be a Matcher or a PolicyRule.

If no attributeID attribute is specified then it is a Matcher (returning that value if it is present amongst the values, and the empty set otherwise)
If an attributeID attribute is specified then it is a PolicyRule (returning true if that that is present amongst the values for the specified attribute).

The Value type is defined in the urn:mace:shibboleth:2.0:afp namespace, the schema for which can be located at http://shibboleth.net/schema/idp/shibboleth-afp.xsd

The deprecated basic:AttributeValueString type is defined in the urn:mace:shibboleth:2.0:afp:mf:basic namespace, the schema for which can be located at http://shibboleth.net/schema/idp/shibboleth-afp-mf-basic.xsd

Three attributes may be specified

Name	Type	Default	Description
attributeID	String	none	If this is present, then this is a PolicyRule returning true if the matching attribute contains the supplied value. If this is not present, then this is a Matcher returning that value if it is present amongst the values, and the empty set otherwise.
value	String	required	The value to match against
ignoreCase	Boolean	`true`	Whether the matching is case insensitive

None

<PolicyRequirementRule xsi:type="Value" value="jsmith" attributeID="uid"/>

Apply this rule if the attribute "uid" contains a value "jsmith"

<AttributeRule attributeID="uid">
   <PermitValueRule xsi:type="Value" value="jsmith" ignoreCase="true" />
</AttributeRule>

If the attribute "uid" contains the value "jsmith" then add "jsmith to the permitted values to be release for "uid"

<PolicyRequirementRule xsi:type="Value" value="jsmith"/>

Apply this rule if any attribute contains a value "jsmith"

<AttributeRule attributeID="email">
   <PermitValueRule xsi:type="Value" value="jsmith" ignoreCase="true" attributeID="uid"/>
</AttributeRule>

If the attribute "uid" contains the value "jsmith" then release all values of "email" .