The following example is the ARPs used by the OhioLINK staff IdP. It releases the eduPersonPrincipalName attribute only to the OhioLINK servers and Internet2.
<?xml version="1.0" encoding="UTF-8"?>
<AttributeReleasePolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:mace:shibboleth:arp:1.0" xsi:schemaLocation="urn:mace:shibboleth:arp:1.0 shibboleth-arp-1.0.xsd" >
       <Description>OhioLINK Staff ARP</Description>
       <Rule>
               <Target>
                       <Requester matchFunction="urn:mace:shibboleth:arp:matchFunction:regexMatch">
https://.+\.ohiolink\.edu/shibboleth
</Requester>
               </Target>
               <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName">
                       <AnyValue release="permit"/>
               </Attribute>
       </Rule>
       <Rule>
               <Target>
                       <Requester matchFunction="urn:mace:shibboleth:arp:matchFunction:exactShar">
https://spaces.internet2.edu/shibboleth
</Requester>
               </Target>
               <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName">
                       <AnyValue release="permit"/>
               </Attribute>
       </Rule>
</AttributeReleasePolicy>
|
|