SP - attribute-policy.xml - filter by entity?

[Cantor, Scott]

> Thanks for the replies. I'm still a shib noob so apologies if I'm getting
> terminology wrong and causing confusion!

You're not getting anything wrong that people who use the software a lot are also likely to get wrong. And it's likely the federations themselves don't understand the matter either. I'm just trying to give you a clearer picture of the problem you'e trying to solve.

Federations are real world concepts, but not SAML ones. They don't translate directly into things that have significance to the protocol, so the software doesn't directly recognize them without using conventions.

> @Scott: I spoke with the 4th federation and I think it was a translation issue
> as now its clarified that they are only releasing 4 values (faculty, student,
> staff, other) & not requiring us to ignore some if sent.  I'll ask them about the
> misuse you pointed out.

If you don't have a use for member, then it's moot, but if you're planning to create a policy based on member, the intent of eduPerson was that you should only need to require "member", not "member OR student OR employee OR...etc."

In practice IdPs get this wrong. In future the SP will compensate, but for the time being, it's something you have to deal with.

-- Scott