ADFS authentication with multiple UPNs

[Jason Gauthier]

>>I really don¹t know what has caused this, as a didn¹t explicitly 
>>indicate anything with Œ@lastar.com¹ to succeed, or restrict anything 
>>for other ones (I have 5-7) to fail.
>>Does anyone have a suggestion on how to resolve this?

>Depends what attribute is involved. UPN is something MS made up, and no SP out of the box has any such attribute defined. If you're generating an >eduPersonPrincipalName, then the value is scoped and the suffix has to be approved by policy in either metadata or in the local filter policy on the SP to get it through >the filtering step.

>And there will be logs saying so.

Thanks, I understand.  I am transforming the UPN to an eduPersonPrincipalName.  Unfortunately, I don't know how to scope this, but I am doing some reading.
Shibboleth is not logging -anything- when this happens.  Not in native.log or in shibd.log.