Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


If you wanted to suspend access when users did not have specific attribute values, you would use all - e.g. OU does not match Physics_Department AND OU does not match Chemistry_Department.

Multi-valued attributes

Where attributes are multi-valued, such as memberOf, then all of the values are treated as discrete when evaluated for match conditions and if any of the values meet the condition the rule activates. Because of this, it is usually safer to avoid the negative matches such as 'does not contain' when working with multi-valued attributes and stick with the positive matches such as 'contains' or 'matches'.

Include Page