AttributeValueMatchesShibMDScopeFunctor.cpp ?

[Peter Schober]

The SCHAC schema uses an attribute called schacHomeOrganization
containing the canonical DNS-domain of an institution. Presumably
useful in cases when even sending ePSA is too much
(e.g. student at example.edu) when all you want is a stable idenfier for
the institution (e.g. to match a contract, preventing use of the IDP's
entityID for that).
If you will it's complementing ePA (LHS) and ePSA (LHS at RHS) by giving
you an attribute for the RHS alone.

It's defined to be single-valued and as such can't be replaced with
simply extracting shibmd:Scope from SAML metadata in the SP instead
(as that would potentially result in multiple values; though changing
the attribute to become multi-valued is not inconcievable itself.)

Anyway, not being scoped (i.e., attribute.getScope() fails) we lose
the protection the AttributeScopeMatchesShibMDScope attribute filter
rule in the SP provides for e.g. ePSA (or ePPN).

Would it make sense (and would the project consider including a rule
for schacHomeOrganization to the default attribute-policy.xml) to add
a copy of the AttributeScopeMatchesShibMDScope functor that matches an
attribute value (string) against shibmd:Scope, i.e. to create an
AttributeValueMatchesShibMDScope rule?
-peter