Native SP AttributeFilter for eppn and default "ScopingRules"

[Don Faulkner]

My SP install came with the following:

    <afp:PermitValueRule id="ScopingRules" xsi:type="AND">
        <Rule xsi:type="NOT">
            <Rule xsi:type="AttributeValueRegex" regex="@"/>
        </Rule>
        <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope"/>
    </afp:PermitValueRule>

        <afp:AttributeRule attributeID="eppn">
            <afp:PermitValueRuleReference ref="ScopingRules"/>
        </afp:AttributeRule>


I'm trying to accept eppn and other values from our IdP and another
IdPbut for some reason this AttributeRule is preventing the SP from
accepting eppn from the other IdP. If I change that RuleReference to
<afp:PermitValueRule xsi:type="ANY"/>, then the eppn comes through (as
one would expect.

How do I correctly filter eppn, and similar attributes?

I think I don't understand the ScopingRules. It seems to me to say that
the filter matches if the value does not match "@" and has attribute
scope matching the metadata scope.

I thought scope was represented as "value at scope" so any scoped attribute
would faile the above test.
Which MDScope must the AttributeScope match? The MDScope of the IdP
making the assertion or the MDScope of the SPreceiving the assertion?

Totally not sure where to look for the followingin the wiki. The docs on
this look a little sparse. Can I help?

-- 
me Don Faulkner, CISSP | IT Security <http://its.uark.edu/> at the
University of Arkansas <http://www.uark.edu/>
contact>> donf at uark.edu <mailto:donf at uark.edu> | +1 (479) 575-2905
connect>> uarkITS on Facebook <http://www.facebook.com/uarkITS> | @uaits
<http://twitter.com/uaits> | @dfaulkner <http://twitter.com/dfaulkner>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130218/276daccb/attachment.html