Disallow eppn/affiliation to be asserted by the wrong IdP

[William Spooner]

On 11 Oct 2012, at 12:12, Ian Young wrote:

> 
> On 11 Oct 2012, at 12:09, William Spooner <william.spooner at eaglegenomics.com> wrote:
> 
>> I want to do exactly this, i.e. disallow "staff at osu.edu to be asserted by the Brown University IdP". Although I'm already doing this within my application, it would be great to hand the task off to my SP (shibboleth 2.4.3). I would be very grateful if someone could point me towards some boilerplate config for this.
> 
> This is the default behaviour, there's no need to do anything special.
> 
> 	-- Ian

Thanks Ian, for your rapid response.

I think the penny has dropped! I just need to edit my MetadataProvider XML with the 'correct' IdP scope, and then read e.g. "emailaddress" with a ScopedAttributeDecoder in attribute-map.xml. Cool!

To answer my other question (per-IdP constant Attribute values), I can add <Attribute> names/values directly to the MetadataProvider XML and use AttributeExtractor to hoik them out to be used to set a particular Attribute id. Hmm - I'll have to work on the XML for that.

All the best,

Will