on eduPersonScopedAffiliation (ePSA) and SAML interoperability

[Roberto Benedetti]

here is another problem while trying to make OpenSSO IdP properly work 
with a Shibboleth SP.

we get [1] from a Shibboleth IdP and [2] from a non-Shibboleth IdP 
(ex-SUN OpenSSO).

attributes in [2] were skipped (unmapped) until we modified that IdP's 
metadata adding the "Scope" extension.

I've read that extension is intended so that when the staff responsible 
for the federation management adds a new IdP, they -and only they who 
can manage metadatas- also add the appropriate scope.

is it the expected behaviour?
is it a SAML specification or a Shibboleth-only one?
should [2] with no scope extension be considered SAML compliant? could 
you please provide pointers stating it is/it is not?
would adding a specific attribute filtering rule [3] be preferrable to 
adding the scope extension in the IdP's metadata?

thanks for your support,
   roberto benedetti



[1]
<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" 
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
          <saml2:AttributeValue 
xmlns:xs="http://www.w3.org/2001/XMLSchema" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xs:string">member at shib.idp</saml2:AttributeValue>
          <saml2:AttributeValue 
xmlns:xs="http://www.w3.org/2001/XMLSchema" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xs:string">staff at shib.idp</saml2:AttributeValue>
</saml2:Attribute>


[2]
<saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                 <saml:AttributeValue 
xmlns:xs="http://www.w3.org/2001/XMLSchema" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xs:string">member at nonshib.idp</saml:AttributeValue>
                 <saml:AttributeValue 
xmlns:xs="http://www.w3.org/2001/XMLSchema" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xs:string">staff at nonshib.idp</saml:AttributeValue>
</saml:Attribute>


[3] 
http://shibboleth.1660669.n2.nabble.com/passing-eduPersonScopedAffiliation-question-td7582105.html