Experience with OIDC plugin

[Jim Fox]

>>
>> The attribute filtering behaviour the way you describe it, that should not happen. Could you send me a full log (<logger name="fi.csc" level="ALL"/>) of the event with your attribute filter and resolver files.
>>
>

Sorry, I seem to have gotten confused on Friday.  Attribute filtering is 
working as it should.   Rules by scope alone seem to work.  I do not need the SP-specific rules.

Except I did use it this way:

     <AttributeFilterPolicy id="OPENID_MEMBER_OF">
         <PolicyRequirementRule xsi:type="AND">
            <Rule xsi:type="Requester" value="urizen" />
            <Rule xsi:type="oidcext:OIDCScope" value="edumember_is_member_of" />
         </PolicyRequirementRule>
         <AttributeRule attributeID="gws_groups">
            <PermitValueRule xsi:type="basic:OR">
             <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace:washington.edu:groups:u_fox_00-spud99"/>
             <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace:washington.edu:groups:uw_employee"/>
             <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace:washington.edu:groups:uw_member"/>
             <basic:Rule xsi:type="basic:AttributeValueString" value="urn:mace:washington.edu:groups:uw_staff"/>
             <basic:Rule xsi:type="basic:AttributeValueRegex" regex="urn:mace:washington.edu:groups:u_fox_brow.*"/>
            </PermitValueRule>
         </AttributeRule>
     </AttributeFilterPolicy>


Which is how we could filter memberof attributes by SP.


I also tried to add an attribute to the 'profile' scope,

     <AttributeFilterPolicy id="OPENID_SCOPE_PROFILE">
         <PolicyRequirementRule xsi:type="oidcext:OIDCScope" value="profile" />
         <AttributeRule attributeID="name">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         <AttributeRule attributeID="preferredFirst">
             <PermitValueRule xsi:type="ANY" />
         </AttributeRule>
         ...


Shib's audit log shows it being released on all requests.  However, the atribute never appears in the OIDC response.  It does appear in one place in the geant debug log:

   Profile Action ValidateGrant: authz code unwrapped {"sub":"fox","cnsntd_claims":["displayName"... "preferredFirst" ...

but is seems to otherwise ignored.

Is the 'profile' set of attributes fixed?

Jim