Is this a metadata error?

[Cantor, Scott]

> Ah, ok, that explains it. No, I'm on 2.3.5 here, not 2.4 yet, and I haven't added
> anything to it. I probably need to start reading up on 2.4 and planning to
> upgrade, but for the moment I've been ignoring it.

Well, it doesn't explain why your attribute wasn't released, it just means the metadata isn't why. You'd have to see what the log is saying about the attribute. Maybe it's not resolved for some reason.

> "Best" I'm defining in the identity system, and populating ePA and ePPA
> accordingly. If the app disagrees, that's too bad for them. We have existing
> rules in place for deciding what a person's primary role is between the ideas
> of "student" and "employee".

Sure, but by the same logic you are forced to accept earlier in your note, some vendor will come along and say "nope, sorry, you'll have to reverse that choice of role for my app". It just eventually becomes your problem either way.

> Argh. You're right. I just re-read ePSA and it is multivalued. I mis-
> remembered it being single valued.

That explains the confusion.

> Since ePSA is multi-valued, whether I have it or not isn't going to make a
> difference. I need a single valued "best" view of multi-valued internal data.
> ePPA seems to be the best available defined attribute in eduPerson for this. I
> think I've released ePPA to them, and they're not getting it. From the IdP,
> where do I look? Or do I need to get them to look at the SP to find out what's
> going on there?

Are you sure they really support it? If they're (improperly) expecting a single value of ePSA, maybe they didn't map the primary affiliation attribute at all.

Otherwise, you'll have to check the logs I guess, maybe run the aacli tool to see what gets resolved for that principal. See what the IdP audit log says got released.

If you can verify it's been released, then it's the SP's issue to fix.

-- Scott