shibuser.txt: expressions: Index(str, substr)

My goal: DENY access to user when shibboleth attribute "memberof" does not contain string.

Attribute details:

name: urn:oid:1.3.6.1.4.1.5923.1.5.1.1
friendly name: memberof
value:CN=library-allow-access,OU=AppGroups,OU=IDM-Managed,OU=University-Access,DC=its,DC=uncc,DC=edu

Expression documentation:
https://help.oclc.org/Library_Management/EZproxy/Authenticate_users/Directives_and_configurations_for_authentication/Expressions#Functions

I contend Index() is the most appropriate function:

---
Index(str, substr)     This numeric function check to see if substr is contained with str. 
Returns -1 if substr is not contained within str, or returns the position where substr begins based from 0 (e.g., Index("abc", "d") returns -1, Index("abc", "a") return 0, Index("abc", "c") return 2).
---
aggvar
The base name of a variable that can have one or more value, such as the base name of an array or the name of an auth: variable that returns multiple values; when used with an aggregate test, EZproxy will also include any non-array variable of the specified name in the test (e.g., abc, abc[1], and abc["xyz"] are all considered when performing an aggregate test for the variable abc).
---

It should be as simple as:
If Index(memberof, library-allow-access) = -1; deny

I've tried this and lots of other functions and methods to no avail...  I do have other fully working expressions in shibuser.txt, ex: escalate uid to admin, uid deny, etc.

OCLC has not been able to solve this for me.  I am hoping someone has some insight.  Thank you ahead of time.

Brad Spry
Atkins Library
UNC Charlotte

********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].