<AttributeAcceptancePolicy xmlns="urn:mace:shibboleth:1.0">
<!--
    20100623 SWITCH
    
    Implements the AAI Attribute Specification Version 1.3
    This AAP.xml file reflects the attributes defined in the 
    AAI Attribute Specification that can be found at
    http://www.switch.ch/aai/attributes/
    
    An AAP is a set of AttributeRule elements, each one
    referencing a specific attribute by URI. All attributes that
    should be visible to an application protected by the Service Provider should
    be listed here. Otherwise, they will be filtered out.
    
    The Header and Alias attributes map an attribute to an HTTP header
    and to an htaccess rule name respectively. Without Header, the attribute
    will only be obtainable from the exported SAML assertion in raw XML.
    
    Scoped attributes are also filtered on Scope via the Domain elements
    in the site metadata.
    
    This default configuration accepts all attributes from any Identity 
    Provider.
    A real config could be more selective and only accept what really is needed.
-->

    <!-- Individual attributes -->

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonUniqueID"
      Header="Shib-SwissEP-UniqueID"
      Alias="uniqueID">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:uid"
      Header="Shib-Person-uid"
      Alias="uid">
      <!-- 
      In cases where only users from a single Identity Provider access this 
      Service Provider, it may make sense to set the alias to REMOTE_USER
      -->
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:sn"
      Header="Shib-Person-surname"
      Alias="surname">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:givenName"
      Header="Shib-InetOrgPerson-givenName"
      Alias="givenName">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonMatriculationNumber"
      Header="Shib-SwissEP-MatriculationNumber"
      Alias="matriculationNumber">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonCardUID"
      Header="Shib-SwissEP-CardUID"
      Alias="carduid">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:employeeNumber"
      Header="Shib-InetOrgPerson-employeeNumber"
      Alias="employeeNumber">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonDateOfBirth"
      Header="Shib-SwissEP-DateOfBirth"
      Alias="dateOfBirth">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonGender"
      Header="Shib-SwissEP-Gender"
      Alias="gender">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:preferredLanguage"
      Header="Shib-InetOrgPerson-preferredLanguage"
      Alias="preferredLanguage">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:mail"
      Header="Shib-InetOrgPerson-mail"
      Alias="mail">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:homePostalAddress"
      Header="Shib-InetOrgPerson-homePostalAddress"
      Alias="homePostalAddress">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:postalAddress"
      Header="Shib-OrgPerson-postalAddress"
      Alias="postalAddress">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:homePhone"
      Header="Shib-InetOrgPerson-homePhone"
      Alias="homePhone">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:telephoneNumber"
      Header="Shib-Person-telephoneNumber"
      Alias="telephoneNumber">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:mobile"
      Header="Shib-InetOrgPerson-mobile"
      Alias="mobile">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>


    <!-- Group related attributes -->
    
    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganization"
      Header="Shib-SwissEP-HomeOrganization"
      Alias="homeOrganization">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonHomeOrganizationType"
      Header="Shib-SwissEP-HomeOrganizationType"
      Alias="homeOrganizationType">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:eduPersonAffiliation"
      Header="Shib-EP-Affiliation"
      Alias="affiliation">
      <!-- Filtering rule to limit values to eduPerson-defined enumeration. -->
        <AnySite>
            <Value Type="regexp">^[M|m][E|e][M|m][B|b][E|e][R|r]$</Value>
            <Value Type="regexp">^[F|f][A|a][C|c][U|u][L|l][T|t][Y|y]$</Value>
            <Value Type="regexp">^[S|s][T|t][U|u][D|d][E|e][N|n][T|t]$</Value>
            <Value Type="regexp">^[S|s][T|t][A|a][F|f][F|f]$</Value>
            <Value Type="regexp">^[A|a][L|l][U|u][M|m]$</Value>
            <Value Type="regexp">^[A|a][F|f][F|f][I|i][L|l][I|i][A|a][T|t][E|e]$</Value>
            <Value Type="regexp">^[E|e][M|m][P|p][L|l][O|o][Y|y][E|e][E|e]$</Value>
            <Value Type="regexp">^[L|l][I|i][B|b][R|r][A|a][R|r][Y|y][-][W|w][A|a][L|l][K|k][-][I|i][N|n]$</Value>
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonStudyBranch1"
      Header="Shib-SwissEP-swissEduPersonStudyBranch1"
      Alias="studyBranch1">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonStudyBranch2"
      Header="Shib-SwissEP-swissEduPersonStudyBranch2"
      Alias="studyBranch2">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonStudyBranch3"
      Header="Shib-SwissEP-swissEduPersonStudyBranch3"
      Alias="studyBranch3">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonStudyLevel"
      Header="Shib-SwissEP-swissEduPersonStudyLevel"
      Alias="studyLevel">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:switch.ch:attribute-def:swissEduPersonStaffCategory"
      Header="Shib-SwissEP-swissEduPersonStaffCategory"
      Alias="staffCategory">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:eduPersonOrgDN"
      Header="Shib-EP-OrgDN"
      Alias="orgDN">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:eduPersonOrgUnitDN"
      Header="Shib-EP-OrgUnitDN"
      Alias="orgUnitDN">
        <AnySite>
            <AnyValue />
        </AnySite>
    </AttributeRule>

    <AttributeRule
      Name="urn:mace:dir:attribute-def:eduPersonEntitlement"
      Header="Shib-EP-Entitlement"
      Alias="entitlement">
        <AnySite>
            <AnyValue />
        </AnySite>

        <!-- Entitlements tend to be filtered per-site. -->
        <!-- Example rule that applies to any Identity Provider (Site) -->
        <!--
         <AnySite>
               <Value>https://example.ch/entitlement/value/to/be/accepted</Value>
         </AnySite>
         -->
        
        <!-- Example rule for an Identity Provider (Site) -->
        <!--
         <SiteRule
           Name="urn:mace:switch.ch:SWITCHaai:switch.ch">
             <Value Type="regexp">^urn:mace:.+$</Value>
         </SiteRule>
         -->
    </AttributeRule>

</AttributeAcceptancePolicy>
