Overview

The ValueRegex (basic:AttributeValueRegex prior to V3.2) type matches attributes values against the supplied Java Regular Expression.

Confusingly, theValueRegex type can be a Matcher or a PolicyRequirement.

If no attributeID attribute is specified then it is a Matcher (returning that value if it is present amongst the values, and the empty set otherwise)
If an attributeID attribute is specified then it is a PolicyRule (returning true if that value is present amongst the values for the specified attribute).

Schema Name

The ValueRegex type is defined in the urn:mace:shibboleth:2.0:afp namespace, which can be located at http://shibboleth.net/schema/idp/shibboleth-afp.xsd

The deprecated basic:AttributeValueRegex type was defined in the urn:mace:shibboleth:shibboleth:2.0:afp:basic namespace, the schema for which can be found at http://shibboleth.net/schema/idp/shibboleth-afp-mf-basic.xsd

Two attributes may be specified:

Name	Type	Default	Description
`attributeID`	String	none	If this is present, then this is a PolicyRule returning true if the corresponding attribute exists and contains a value that matches. If this is not present, then this is a Matcher returning any value that matches, and the empty set otherwise.
`regex`	Pattern	required	The regular expression to match against

None

Simple Profile Policy

<PolicyRequirementRule xsi:type="ValueRegex" regex="^hn.*$" attributeID="uid"/>

Apply this rule if the attribute "uid" contains at least one value which starts with "hn"

Simple Matcher

<AttributeRule attributeID="uid">
   <PermitValueRule xsi:type="ValueRegex" regex="^hn.*$" />
</AttributeRule>

Add any values of the attribute "uid" with start "hn" to its permitted values list.

Compound PolicyRule (deprecated)

<PolicyRequirementRule xsi:type="ValueRegex" regex="^hn.*$"/>

Apply this rule if any attribute contains a value which starts with hn

Compound Matcher (deprecated)

<AttributeRule attributeID="email">
   <PermitValueRule xsi:type="ValueRegex" regex="^hn.*$" attributeID="uid"/>
</AttributeRule>

If the attribute "uid" contains any value which starts hn then release all values of "email" .