Google Apps using Shibboleth

[Paul Hethmon]

You are releasing the transient id to Google based on this filter:

On 12/3/12 11:58 AM, "Prasanna" <PVBalachandar at imperosoftware.com> wrote:

><afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">
>         <afp:PolicyRequirementRule xsi:type="basic:NOT">
>                 <basic:Rule xsi:type="basic:AttributeRequesterString"
>value="google.com/a/imperoidm.com" />
>         </afp:PolicyRequirementRule>
>         <afp:AttributeRule attributeID="transientId">
>             <afp:PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
></afp:AttributeFilterPolicy>
>

Your NOT rule uses an entityID that does not match everything else.

Paul