Disallow eppn/affiliation to be asserted by the wrong IdP

[Ian Young]

On 11 Oct 2012, at 12:33, William Spooner <william.spooner at eaglegenomics.com> wrote:

> I think the penny has dropped! I just need to edit my MetadataProvider XML with the 'correct' IdP scope,

Depends where you're getting your metadata from.  If you're getting it from a federation, the normal thing you'll find is that each IdP has the scopes permitted to it listed as <Scope> elements in the metadata itself, so there is no need to configure anything in your SP at all.

> and then read e.g. "emailaddress" with a ScopedAttributeDecoder in attribute-map.xml. Cool!

Email addresses aren't scoped attributes (because, for example, someone from brown.edu might have a gmail.com address) although I realise the @ used to denote the scope is probably confusing in this regard.  The interesting scoped attributes are eduPersonScopedAffiliation and eduPersonPrincipalName.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20121011/61e8f403/attachment-0001.bin