The Shibboleth IdP V3 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP4 wiki space for current documentation on the supported version.
ValueRegexConfiguration
Overview
The ValueRegex (basic:AttributeValueRegex prior to V3.2) type matches attributes values against the supplied Java Regular Expression.
Confusingly, theValueRegex type can be a Matcher or a PolicyRequirement.
- If no
attributeIDattribute is specified then it is a Matcher (returning that value if it is present amongst the values, and the empty set otherwise) - If an
attributeIDattribute is specified then it is a PolicyRule (returning true if that value is present amongst the values for the specified attribute).
Schema Name
The ValueRegex type is defined in the urn:mace:shibboleth:2.0:afp namespace, which can be located at http://shibboleth.net/schema/idp/shibboleth-afp.xsd
The deprecated basic:AttributeValueRegex type was defined in the urn:mace:shibboleth:shibboleth:2.0:afp:basic namespace, the schema for which can be found at http://shibboleth.net/schema/idp/shibboleth-afp-mf-basic.xsd
Attributes
Two attributes may be specified:
| Name | Type | Default | Description |
|---|---|---|---|
attributeID | String | none | If this is present, then this is a PolicyRule returning true if the corresponding attribute exists and contains a value that matches. If this is not present, then this is a Matcher returning any value that matches, and the empty set otherwise. |
regex | Pattern | required | The regular expression to match against |
Child Elements
None
Examples
<PolicyRequirementRule xsi:type="ValueRegex" regex="^hn.*$" attributeID="uid"/>
Apply this rule if the attribute "uid" contains at least one value which starts with "hn"
<AttributeRule attributeID="uid"> <PermitValueRule xsi:type="ValueRegex" regex="^hn.*$" /> </AttributeRule>
Add any values of the attribute "uid" with start "hn" to its permitted values list.
<PolicyRequirementRule xsi:type="ValueRegex" regex="^hn.*$"/>
Apply this rule if any attribute contains a value which starts with hn
<AttributeRule attributeID="email"> <PermitValueRule xsi:type="ValueRegex" regex="^hn.*$" attributeID="uid"/> </AttributeRule>
If the attribute "uid" contains any value which starts hn then release all values of "email" .