On 6/21/12 12:19 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote: >If our metadata's correct is the key, I believe. We need to have the >proper extension in the metadata for the IDP to tell the SP that >example.com is a valid scope for this IDP to assert. Is that correct? Yes. Or create a custom filter rule of course. -- Scott