passing eduPersonScopedAffiliation question.

[Cantor, Scott]

On 9/27/12 11:26 AM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:

>They supply their metadata to me via a URL:
>https://idpstarid.mnscu.edu/idp/profile/Metadata/SAML
>
>Is there a simple change I can ask them to do on their side to fix this?

I don't know how they're producing their metadata. I'm just saying that
the simplest fix is for that metadata to include the extension. If they
get the metadata from some automated tool in a commercial product, then I
expect it's not so simple. If it's Shibboleth or the metadata's hand
generated, it should be straightforward to add it.

If you want to change your filter policy, you'd need to start by reading
the IdP documentation (SP uses the same filtering language more or less)
and look at the existing filter file. If you understand the syntax and the
rules, you can change them.

The match function for basing policy on the IdP name is
AttributeIssuerString. If you take the existing policy that contains the
scoped attributes and change the ANY to a match on the entityID and wrap
that in a NOT then you have an exclusion for that IdP so the standard
rules don't run. Then you can create a separate policy applying to that
entityID alone, and you can stick in a rule that applies the
AttributeScopeString function checking for their scope.

-- Scott