From 6bbcd95069006d4cb50c1bda4b9a5d8fde035ba9 Mon Sep 17 00:00:00 2001
From: Jonathan Perret <j-github@jonathanperret.net>
Date: Tue, 11 Mar 2025 15:37:22 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(config)=20allow=20more=20affiliati?=
 =?UTF-8?q?ons?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We agreed with RENATER to allow people having one of the following
affiliations: faculty, staff, employee, researcher, teacher.
---
 CHANGELOG.md                                                  | 1 +
 src/satosa/plugins/microservices/attribute_authorization.yaml | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 496ff07..40f9cd9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ and this project adheres to
 
 ## Unreleased
 - upgrade to SATOSA 8.5.1
+- allow faculty, staff, employee, researcher, teacher affiliations
 
 ## [1.0.5] - 2025-03-06
 - add allowlist for URL paths to nginx ingress
diff --git a/src/satosa/plugins/microservices/attribute_authorization.yaml b/src/satosa/plugins/microservices/attribute_authorization.yaml
index cf1a67b..41b6ddd 100644
--- a/src/satosa/plugins/microservices/attribute_authorization.yaml
+++ b/src/satosa/plugins/microservices/attribute_authorization.yaml
@@ -13,4 +13,8 @@ config:
           # later in the PrimaryIdentifier processor.
           - ".+"
         eduPersonAffiliation:
+          - "^faculty$"
+          - "^staff$"
           - "^employee$"
+          - "^researcher$"
+          - "^teacher$"