wiki error

[David Champion]

* On 03 Jul 2013, Tom Scavo wrote: 
> Error in the wiki:
> 
> https://wiki.shibboleth.net/confluence/pages/diffpages.action?pageId=7307335&originalId=12451910

This was my edit. I don't know whether the error occurs because of my
ludicrous Confluence user name (my institution doesn't release eppn to
shibboleth.net) but perhaps?

To your underlying question, what was changed:
* updated the "issuer" text in the <ul> under External Auth Handler > Technical Specs > Input Format and Processing Model. It was a little vague.
* added the ISO time link for "AuthnInstant" bullet, and added ISO8601 example. This just seemed useful to have for an implementor.
* added the following paragraph:

Attributes placed into the ExternalAuth POST will be subjected to attribute policy as defined in the attribute-policy.xml file. This could be particularly significant if you define an attribute whose policy enforcement rests upon metadata properties. For example, any scoped attribute (such as eppn or affiliation) may incorporate the ScopingRules rule, which is predicated on a metadata definition of scope, referenced by the issuer's entityID. In this case you may need to adjust policy to accomodate arbitrary scope on these attributes.

This paragraph is to address a problem I encountered.  I spent the
better part of an hour working out why the SP was giving this message
with no explanation:

2013-07-02 14:05:17 WARN Shibboleth.AttributeFilter [1]: removed value at position (0) of attribute (eppn) from (unknown source)

It's because under the default eppn attribute policy, you need an
expected scope, and you can only have that by having metadata for your
issuer's entityID, which presumably the backdoor approach doesn't
typically involve.  (I certainly don't know what metadata for a fake
issuer would look like....)  I don't think my new paragraph is very
clear (because I'm making this up as I go based on ill-understood
observations), but it at least points in a useful direction.

Probably it would be useful to have this in a table of common errors.
I don't know whether it would be preferable to create a new one for
NativeSPBackDoor, or to cite it in the general SP errors triage page.

-- 
       David Champion • dgc at uchicago.edu • University of Chicago
Enrico Fermi Institute • Computation Institute • USATLAS Midwest Tier 2