Is this a metadata error?

[Cantor, Scott]

> which I *think* means that I'm releasing these attributes to any SP defined in
> the InCommon metadata. I release ePPN to anybody.

But are you actually creating and supporting eduPersonPrimaryAffiliation in your resolver?

> If I'm reading this correctly, the SP defined in the metadata expects to get cn,
> eduPersonAffiliation, and mail. It doesn't mention
> eduPersonPrimaryAffiliation, so it doesn't get ePPA, which is why it can't
> display ePPA at the test page.

It may be incompete but it has nothing to do with your attribute release unless you're deploying the filter plugin that uses that metadata (your example did not).

Of course if you did deploy that plugin, that could well prevent the release.

Personally, I think no vendor should use that attribute anyway. The concept of  "primary" is pretty meaningless and is best avoided IMHO. It might make sense for searching, but not authorization.

-- Scott