The Shibboleth IdP V4 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP5 wiki space for current documentation on the supported version.

AttributeRuleConfiguration

Owned by Scott Cantor
Last updated: Apr 18, 2022 by Clay Cooper
1 min read

Namespace: urn:mace:shibboleth:2.0:afp
Schema: http://shibboleth.net/schema/idp/shibboleth-afp.xsd

Overview

An <AttributeRule> defines a filter operation to be applied to the values of one specific attribute.

Each rule is either a permit rule, in which case the filtered values are added to the permit list, or a deny rule, in which case the filtered attributes are added to the deny list (see here).

Reference

Name

Type

Description

Name

Type

Description

attributeID

String

This required attribute specifies the IdPAttribute name (as defined by an <AttributeDefinition> plugin in the AttributeResolverConfiguration). Note, this is the internal name of the IdPAttribute "private" to the IdP and not anything to do with the name of a formalized SAML Attribute.

permitAny

Boolean

If this is present and set to "true", then there are no child elements allowed, and is shorthand for:

<AttributeRule attributeID="..."> <PermitValueRule xsi:type="ANY" /> </AttributeRule>

Name

Cardinality

Description

Name

Cardinality

Description

<PermitValueRule> or <DenyValueRule>

1

The permit or deny rule to apply to the specified attribute's values.

Â