on eduPersonScopedAffiliation (ePSA) and SAML interoperability

[Cantor, Scott]

On 4/23/13 10:06 AM, "Roberto Benedetti" <r.benedetti at cineca.it> wrote:

>I've read that extension is intended so that when the staff responsible
>for the federation management adds a new IdP, they -and only they who
>can manage metadatas- also add the appropriate scope.

Or you can configure rules yourself in your SP. Or turn it off entirely.

>is it the expected behaviour?

By default, yes.

>is it a SAML specification or a Shibboleth-only one?

The concept of scope is a Shibboleth one, or more precisely an eduPerson
concept developed by me and implemented in Shibboleth using various tools
including a SAML metadata extension. That part is a Shibboleth thing.

>should [2] with no scope extension be considered SAML compliant?

The attribute itself is defined by eduPerson and it is scoped. There is
nothing in the SAML expression that has anything to do with this. The
scope concept itself is a policy overlay one puts on the data in its
existing form. This is a difference from the syntax used in SAML 1.1.

How you then handle that as a relying party is up to you. Shibboleth
treats scoped attributes with policy defaults that rely on metadata. The
metadata extension is a Shibboleth extension. If you don't want it, don't
use it.

>would adding a specific attribute filtering rule [3] be preferrable to
>adding the scope extension in the IdP's metadata?

Preferable to who?

-- Scott