Disallow eppn/affiliation to be asserted by the wrong IdP

[Peter Schober]

* William Spooner <william.spooner at eaglegenomics.com> [2012-10-11 18:06]:
> The upshot; it's going to be too much effort to configure shibboleth
> to handle this natively at the SP end. My solution is an apache
> PerlAuthzHandler that uses the persistent-id to check that the
> userid is from the correct IdP entity based on per-IdP
> regexps. Using a handler means that the application layer remains
> unaware of IdP shenanigans. Bit of a shame, but it's a case of
> "better the devil you know".

No idea what these "userid"s are (probably email adresses?) but we can
assume they're not scoped attributes on the wire (but simple string
values), so you can't check scopes on them, yes.
While you could probably create AttributeValueRegex type rules in your
attrobute-policy.xml to make sure arbitrary string values can only
come from some IdPs but not others I would agree that this is not
making your life or deployment easier.
-peter