configuring meta-attributes in the Shib IdP

[Tom Scavo]

Scott will immediately know what I'm talking about but I'll add a
little more context for level-setting purposes.

How do I configure a meta-attribute in the Shib IdP software?
Specifically, I want to configure a policy rule something like this:

<afp:AttributeFilterPolicy id="releaseEssentialAttributesToAnySP">

  <afp:PolicyRequirementRule xsi:type="basic:ANY"/>

  <afp:AttributeRule attributeID="metaPublicUserID">
    <afp:PermitValueRule xsi:type="basic:ANY"/>
  </afp:AttributeRule>

  <afp:AttributeRule attributeID="metaPersonName">
    <afp:PermitValueRule xsi:type="basic:ANY"/>
  </afp:AttributeRule>

  <afp:AttributeRule attributeID="metaEmailAddress">
    <afp:PermitValueRule xsi:type="basic:ANY"/>
  </afp:AttributeRule>

</afp:AttributeFilterPolicy>

where the meta-attributes metaPublicUserID, metaPersonName, and
metaEmailAddress are mapped to wire attributes on a per-IdP basis. For
example, either of the following wire attributes could be mapped to
metaPublicUserID:

- eduPersonUniqueId
- eduPersonPrincipalName (if non-reassigned)

The OpenID Connect public 'sub' claim might be included someday as well.

I'll be happy to help write a wiki page on this topic if someone will
get me started.

Thanks,

Tom