Hello:
I am trying to control which attributes are released in a response from an unsolicited SSO flow. The following attribute policy is being used:
<afp:AttributeFilterPolicy id="releaseToKrames">
<afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://kod.musc.edu" />
<afp:AttributeRule attributeID="UserName">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
<afp:AttributeRule attributeID="AccountName">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
</afp:AttributeFilterPolicy>
The flow is being tested by calling the unsolicited SSO URL in the IdP along with the providerId="https://kod.musc.edu". Instead of only releasing the 2 attributes above, my IdP is releasing all of the attributes that are mapped in my generic "basic:ANY" policy, and sent to the location of the AssertionConsumerService in my metadata.
Is it possible to setup an AttributeFilterPolicy based on the value of the providerID from an unsolicited SSO? My thought was the providerID would translate into the value of the AttributeRequesterString in the AttributeFilterPolicy, but that doesn't appear to be the case.
Any insight would be greatly appreciated!
Thanks
Rob Castellow
Systems Engineer
IAS, OCIO
Medical University of South Carolina
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120328/147290ae/attachment.html