Action from last week - what do we do with anonymous requests when there is a filter which assumes metadata

[Rod Widdowson]

> I'm open to being overruled, but I did have the view that saying "NOT in
> group X" should succeed in the absence of metadata. From the code's PoV,
> we have no reason to believe the entity is in that group, so...
> 
> I understand the ambiguity, but I also think NOT/Deny rules in general are
> always subject to information suppression attacks. Use them at your peril.

I have zero exposure to real deployment situations so I'm happy to follow
your steer on this.

It's not a bug change but I don't want to lose track of this so I have
entered https://issues.shibboleth.net/jira/browse/IDP-331 to track it