<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I am working on a prototype to learn how IdPPrincipalAttribute might work. I have set up external authn with an external servlet and in the final leg of authentication, I am passing a subject under SUBJECT_KEY back. Working off of a new in the archives, I let the final subject have 3 IdPPrincipalAttribute instances and a UsernamePrincipal. Each IdPPrincipalAttribute in the collection has an IdPAttribute wrapped inside it with a name and a String value. Attributes themselves don’t have display names, descriptions or encoders associated with them. Just an id and value(s). </div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I can see ExternalAuthenticationImpl grabs the final subject fine. </div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Then, I set up filtering policies for my SP, used “example1” for simplicity as the policy rule and indicated that all 3 of those attributes should be released regardless of value. None of those attributes are defined anywhere else in the IdP. They are just in the filtering policies. Then I see:</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><div id="bloop_customfont" style="font-size: 13px; margin: 0px;">> Attribute Filter Policy 'example1' Policy is active for this request</div><div id="bloop_customfont" style="font-size: 13px; margin: 0px;">> Attribute Filter Policy 'example1' Applying attribute filter policy to current set of attributes: [uid, eduPersonPrincipalName, eduPersonScopedAffiliation, mail]</div><div id="bloop_customfont" style="font-size: 13px; margin: 0px;">> Attribute filtering engine '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_ce72f47d19f8ed927f12e9fea038874c' Filtering values for attribute 'uid' which currently contains 1 values</div><div id="bloop_customfont" style="font-size: 13px; margin: 0px;"><br></div><div id="bloop_customfont" style="font-size: 13px; margin: 0px;">What might I have to do to let the current set of attributes handle what is resolved outside the IdP from those principal attributes of the external context? </div></div><br><div id="bloop_sign_1472115605595706880" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px">-- <br>Misagh</div></div></body></html>