The Shibboleth IdP V3 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP4 wiki space for current documentation on the supported version.
ValueConfiguration
Overview
The Value (basic:AttributeValueString prior to V3.2) type compares attributes values against the supplied string.
Confusingly, this type can be a Matcher or a PolicyRule.
If no
attributeIDattribute is specified then it is a Matcher (returning that value if it is present amongst the values, and the empty set otherwise)If an
attributeIDattribute is specified then it is a PolicyRule (returning true if that that is present amongst the values for the specified attribute).
Schema Name
The Value type is defined in the urn:mace:shibboleth:2.0:afp namespace, the schema for which can be located at http://shibboleth.net/schema/idp/shibboleth-afp.xsd
The deprecated basic:AttributeValueString type is defined in the urn:mace:shibboleth:2.0:afp:mf:basic namespace, the schema for which can be located at http://shibboleth.net/schema/idp/shibboleth-afp-mf-basic.xsd
Attributes
Three attributes may be specified
Name | Type | Default | Description |
|---|---|---|---|
| String | none | If this is present, then this is a PolicyRule returning true if the matching attribute contains the supplied value. |
| String | required | The value to match against |
| Boolean |
| Whether the matching is case insensitive |
Child Elements
None
Examples
Simple Profile Policy
<PolicyRequirementRule xsi:type="Value" value="jsmith" attributeID="uid"/>Apply this rule if the attribute "uid" contains a value "jsmith"
Simple Matcher
<AttributeRule attributeID="uid">
<PermitValueRule xsi:type="Value" value="jsmith" ignoreCase="true" />
</AttributeRule>If the attribute "uid" contains the value "jsmith" then add "jsmith to the permitted values to be release for "uid"
Compound PolicyRule (deprecated)
<PolicyRequirementRule xsi:type="Value" value="jsmith"/>Apply this rule if any attribute contains a value "jsmith"
Compound Matcher (deprecated)
<AttributeRule attributeID="email">
<PermitValueRule xsi:type="Value" value="jsmith" ignoreCase="true" attributeID="uid"/>
</AttributeRule>If the attribute "uid" contains the value "jsmith" then release all values of "email" .