Is this a metadata error?

[Cantor, Scott]

> Hm. I'll have to plead ignorance here. I don't know if I have, or not, and I
> don't know where to look. Where would a filter plugin be deployed or
> defined?

https://wiki.shibboleth.net/confluence/x/SIG3

Unless you're on 2.4 or added this plugin from uApprove and installed a rule using the AttributeInMetadata match function, you're not using it.

> What they need is an indication that the authenticated person is a "student"
> or "employee". These are mutually exclusive in their system.

Ah, then I think they have a bug because people do not exist in mutually exclusive states.
 
I would say that one might provision which role somebody is meant to have, and then whatever role is assigned has to match one of the asserted values you give them.

But the best answer is to use entitlements, and not try and use affiliation at all. That's a much better fit for the problem.
 
> ePA is multivalued, and a person could be both "student" and "employee" here. By
> populating ePPA with the "best" single value of ePA, it seemed to me that
> having this vendor use ePPA would meet their needs in a way that made the
> most sense.

One example of how this breaks: the attribute value you populate shouldn't depend on the application (because affiliations are not an app-specific concept). Now consider you have two apps with this same bug, but in the two cases, the "best" fit for a given student employee isn't the same in both cases.

> Looking at the InCommon metadata, it looks like I'm not the only one trying
> to do something like this with this vendor, other sites are using
> eduPersonScopedAffiliation, probably for the same reason. I'm not seeing a
> big difference between an ePPA of "student" vs. an ePSA of
> "student at niu.edu" really.

No unscoped version of affiliation really has any use case within a federated system, because without the scope it isn't sufficiently identifying. We really don't expect to see any of them but ePSA in SAML.

ePSA itself is a scoped version of ePA, meaning it's multi-valued. So it's not at all the same as using ePPA. It is entirely different in the area we're discussing.

> Is there a better way to solve this problem? What would you use if not
> ePPA?

I'd use entitlements, depending on how the roles are meant to be provisioned and controlled.

-- Scott