{"id":12013,"date":"2025-12-16T10:20:29","date_gmt":"2025-12-16T15:20:29","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=12013"},"modified":"2026-02-12T10:43:00","modified_gmt":"2026-02-12T15:43:00","slug":"pingfederate-saml-issuance-criterion-or-operator","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=12013","title":{"rendered":"PingFederate SAML Issuance Criterion – Or Operator"},"content":{"rendered":"\n

We use the “Issuance Criteria” to restrict access to applications that do just-in-time provisioning without processing group memberships to restrict who<\/em> gets provisioned. The GUI, however, has an implicit AND<\/em> operator … which means you cannot be allowed to log on if you are a member of X or<\/em> Y<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

To use an OR<\/em> operator, you need to use an OGNL expression. Show the advanced criteria<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

Use an OGNL expression — this is an example allowing members of two groups<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n
\n<urn:TokenAuthorizationIssuanceCriterion AttrName="" AttrSourceType="Expression" ComparisonValue="" ErrorResult="No Role Assigned">\n     <urn:ExprText>#group = #this.get("memberOf"), #group.toString().contains("Scribe - Creator Access") || #group.toString().contains("Scribe - Viewer Access") ? @java.lang.Boolean@TRUE : @java.lang.Boolean@FALSE<\/urn:ExprText>\n<\/urn:TokenAuthorizationIssuanceCriterion>\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"
We use the “Issuance Criteria” to restrict access to applications that do just-in-time provisioning without processing group memberships to restrict who gets provisioned. The GUI, however, has an implicit AND operator … which means you cannot be allowed to log on if you are a member of X or Y To use an OR operator, …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2114],"tags":[2116],"class_list":["post-12013","post","type-post","status-publish","format-standard","hentry","category-pingfederate","tag-ognl"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=12013"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12013\/revisions"}],"predecessor-version":[{"id":12017,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/12013\/revisions\/12017"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}