<afp:AttributeFilterPolicyGroup
    xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"
    xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
    xmlns:afp="urn:mace:shibboleth:2.0:afp"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:switchmd="http://www.switch.ch/aai/metadata/extensions"
    xsi:schemaLocation="urn:mace:shibboleth:2.0:afp /opt/shibboleth-sp/share/xml/shibboleth/shibboleth-2.0-afp.xsd urn:mace:shibboleth:2.0:afp:mf:basic /opt/shibboleth-sp/share/xml/shibboleth/shibboleth-2.0-afp-mf-basic.xsd urn:mace:shibboleth:2.0:afp:mf:saml /opt/shibboleth-sp2/share/xml/shibboleth/shibboleth-2.0-afp-mf-saml.xsd">

    <afp:AttributeFilterPolicy>
        <!-- This policy is in effect in all cases. -->
        <afp:PolicyRequirementRule xsi:type="ANY"/>


        <!-- Regular expression filter for E-mail -->
        <afp:AttributeRule attributeID="Shib-InetOrgPerson-mail">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^.+@.+$" />
        </afp:AttributeRule>

        <!-- Value filter for Home organization type -->
        <afp:AttributeRule attributeID="Shib-SwissEP-HomeOrganizationType">
            <afp:PermitValueRule xsi:type="OR" ignoreCase="true">
                 <Rule xsi:type="AttributeValueString" value="university"/>
                 <Rule xsi:type="AttributeValueString" value="uas"/>
                 <Rule xsi:type="AttributeValueString" value="hospital"/>
                 <Rule xsi:type="AttributeValueString" value="library"/>
                 <Rule xsi:type="AttributeValueString" value="tertiaryb"/>
                 <Rule xsi:type="AttributeValueString" value="uppersecondary"/>
                 <Rule xsi:type="AttributeValueString" value="vho"/>
                 <Rule xsi:type="AttributeValueString" value="others"/>
            </afp:PermitValueRule>
        </afp:AttributeRule>

        <!-- Value filter for Affiliation -->
        <afp:AttributeRule attributeID="Shib-EP-Affiliation">
            <afp:PermitValueRule xsi:type="OR" ignoreCase="true">
                 <Rule xsi:type="AttributeValueString" value="faculty"/>
                 <Rule xsi:type="AttributeValueString" value="student"/>
                 <Rule xsi:type="AttributeValueString" value="staff"/>
                 <Rule xsi:type="AttributeValueString" value="alum"/>
                 <Rule xsi:type="AttributeValueString" value="member"/>
                 <Rule xsi:type="AttributeValueString" value="affiliate"/>
            </afp:PermitValueRule>
        </afp:AttributeRule>

        <!-- Regular expression filter for Unique ID -->
        <afp:AttributeRule attributeID="Shib-SwissEP-UniqueID">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^.+@.+$" />
        </afp:AttributeRule>

        <!-- Regular expression filter for Study branch 3 -->
        <afp:AttributeRule attributeID="Shib-SwissEP-swissEduPersonStudyBranch3">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^\d+$" />
        </afp:AttributeRule>

        <!-- Regular expression filter for Study level -->
        <afp:AttributeRule attributeID="Shib-SwissEP-swissEduPersonStudyLevel">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^\d+\-\d+$" />
        </afp:AttributeRule>

        <!-- Regular expression filter for Staff category -->
        <afp:AttributeRule attributeID="Shib-SwissEP-swissEduPersonStaffCategory">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^\d+$" />
        </afp:AttributeRule>

        <!-- Regular expression filter for Matriculation number -->
        <afp:AttributeRule attributeID="Shib-SwissEP-MatriculationNumber">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^\d{8}$" />
        </afp:AttributeRule>

        <!-- Regular expression filter for Date of birth -->
        <afp:AttributeRule attributeID="Shib-SwissEP-DateOfBirth">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^\d{8}$" />
        </afp:AttributeRule>

        <!-- Value filter for Gender -->
        <afp:AttributeRule attributeID="Shib-SwissEP-Gender">
            <afp:PermitValueRule xsi:type="OR" ignoreCase="true">
                 <Rule xsi:type="AttributeValueString" value="0"/>
                 <Rule xsi:type="AttributeValueString" value="1"/>
                 <Rule xsi:type="AttributeValueString" value="2"/>
                 <Rule xsi:type="AttributeValueString" value="9"/>
            </afp:PermitValueRule>
        </afp:AttributeRule>

        <!-- Regular expression filter for Study branch 1 -->
        <afp:AttributeRule attributeID="Shib-SwissEP-swissEduPersonStudyBranch1">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^\d+$" />
        </afp:AttributeRule>

        <!-- Regular expression filter for Study branch 2 -->
        <afp:AttributeRule attributeID="Shib-SwissEP-swissEduPersonStudyBranch2">
            <afp:PermitValueRule xsi:type="basic:AttributeValueRegex" regex="^\d+$" />
        </afp:AttributeRule>

        <!-- Catch-all that passes everything else through unmolested. -->
        <afp:AttributeRule attributeID="*">
            <afp:PermitValueRule xsi:type="ANY"/>
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>

</afp:AttributeFilterPolicyGroup>
