accepting scoped attributes at the SP

[Cantor, Scott]

On 10/18/13 1:13 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

>* Tom Scavo <trscavo at gmail.com> [2013-10-18 01:34]:
>> This is a FAQ but I can't find the wiki page that tells how to
>> configure an SP to accept an arbitrary scoped attribute regardless of
>> what's in IdP metadata. For example, I want to configure the SP to
>> accept any scoped attribute with scope "@internet2.edu" from a
>> particular IdP. Can someone tell me how to do that?
>
>The rules for the SP's attribute-policy.xml (which is where this is
>implemented) are the same as those for the IdP's attribute-filter.xml,
>and for that reason I think there's no seperate documentation on the
>former.

And time, but yes.

The usual function to apply is described in
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirementAt
tributeScopeString

One would normally do an OR in the AttributeRule between that and the
metadata-based one that's already in the file.

There's a reused rule in the default file that gets applied to both the
scoped attributes, so the easiest way is to extend that base rule.

-- Scott