<?xml version="1.0" encoding="UTF-8"?>
<AttributeReleasePolicy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:mace:shibboleth:arp:1.0" xsi:schemaLocation="urn:mace:shibboleth:arp:1.0 shibboleth-arp-1.0.xsd" >

  <!--
  SWITCHaai arp.site.xml
  Sample ARP for SWITCH - The Swiss Education & Research Network (SWITCHaai Federation)
  This file can be used for a first installation on a Shibboleth IdP
  It allows the release of all attributes to the following resources:
  - tools.vho-switchaai.ch
  - tools.switch.ch (SWITCHaai Resource Registry, SWITCHaai + AAI Test)
  - aai-viewer.switch.ch (Attribute Viewer, SP 1.3, SWITCHaai)
  - kelimutu.switch.ch (Attribute Viewer, SP 1.3, AAI Test)

  Legend:
  WARNING:REQUIRED
	This attribute is required by the resource but 
	the general ARP for this HomeOrg doesnt allow its release.
	This can cause problems for users that want to use this resource.
	Please read the comment that follows this warning why this attribute
	is required.
	
  NOTICE:DESIRED
	This attribute is desired by the resource but 
	the general ARP for this HomeOrg doesnt allow its release.
	Please read the comment that follows this warning why this attribute
	is required.
  -->

	<Description>General ARP:
	This file contains the custom Attribute Release Policies for 
	the HomeOrg vho-switchaai.ch. If you want to make additional rules to further 
	restrict the release of certain attributes to certain HomeOrgs, take 
	a look at https://aai-rr.switch.ch/ You should find a Perl script that allows to define custom rules for certain attributes and HomeOrgs</Description>


	<!--RESOURCE_NAME#VHO 1.3 Tools--> 
	<Rule>
		<Target>
			<Requester>https://tools.vho-switchaai.ch/shibboleth</Requester>
			<AnyResource/>
		</Target>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganizationType">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonUniqueID">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:sn">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:givenName">
			<AnyValue release="permit"/>
		</Attribute>
	</Rule>
	
	<!--RESOURCE_NAME#Attributes Viewer 1.3--> 
	<Rule>
		<Target>
			<Requester>https://aai-viewer.switch.ch/shibboleth</Requester>
			<AnyResource/>
		</Target>
		<Attribute name="urn:mace:dir:attribute-def:preferredLanguage">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:mail">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:postalAddress">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:telephoneNumber">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganization">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganizationType">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonUniqueID">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:sn">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:givenName">
			<AnyValue release="permit"/>
		</Attribute>
	</Rule>

	<!--RESOURCE_NAME#Attributes Viewer 1.3, AAI-Test --> 
	<Rule>
		<Target>
			<Requester>https://kelimutu.switch.ch/shibboleth</Requester>
			<AnyResource/>
		</Target>
		<Attribute name="urn:mace:dir:attribute-def:preferredLanguage">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:mail">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:postalAddress">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:telephoneNumber">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganization">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganizationType">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonUniqueID">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:sn">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:givenName">
			<AnyValue release="permit"/>
		</Attribute>
	</Rule>
	

	
	<!--RESOURCE_NAME#AAI Resource Registry--> 
	<Rule>
		<Target>
			<Requester>https://aai-rr.switch.ch/shibboleth</Requester>
			<AnyResource/>
		</Target>
		<Attribute name="urn:mace:dir:attribute-def:mail">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:eduPersonOrgDN">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonUniqueID">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:sn">
			<AnyValue release="permit"/>
		</Attribute>
		<Attribute name="urn:mace:dir:attribute-def:givenName">
			<AnyValue release="permit"/>
		</Attribute>
                <Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganization">
                        <AnyValue release="permit"/>
                </Attribute>
                <Attribute name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganizationType">
                        <AnyValue release="permit"/>
                </Attribute>
	</Rule>

	<!--DEFAULT_RULE#Prevents rogue SPs to get any attribute-->
	<Rule>
		<Target>
			  <AnyTarget/>
		</Target>
	</Rule>

</AttributeReleasePolicy>
