Disallow eppn/affiliation to be asserted by the wrong IdP

[Cantor, Scott]

On 10/11/12 6:05 PM, "William Spooner" <william.spooner at eaglegenomics.com>
wrote:
>
>I can't see any difference between scoped and non-scoped Attributes in
>the Assertion from the IdP, which leads me to assume that I can
>arbitrarily 'scope' any attribute by specifying an AttributeDecoder. The
>key problem as I see it is defining scope to a MetadataProvider where it
>is omitted by the provider themselves.

You can, you just shouldn't. Scope is a semantic concept that doesn't
apply to attributes just because they have a domain on the end. The reason
is the opposite of your problem: imposing scoped processing by accident on
something that isn't really meant to be filtered on that basis. Email
address is definitely such a case.

>Per-IdP AttributeValueRegex sounds interesting, but I can't find any
>documentation for the SP side of things. In the mean time my Apache
>handler is providing equivalent functionality.

It's the same syntax as the IdP filtering langauge more or less, mostly
more. PolicyRequirementRule based on the IdP entityID, then an attribute
rule applying whatever matching rule you want.

-- Scott