SP not receiving all ePSA values from IDP

[Peter Schober]

* Zico <mailzico at gmail.com> [2014-02-20 11:32]:
> Lately I am facing an interesting situation. I am trying to pass three
> types of ePSA values from my IDP. 1. manager at private.com 2.
> manager at home.private.com. 3. staff at private.com.

1. Because the Shibboleth SP by default enforces the used attributes
definition, see "Permissible values" in
http://macedir.org/specs/eduperson/#eduPersonAffiliation

To make the SP accept other values you'd need to adapt the
"eduPersonAffiliationValues" rule in the SP's attribute-policy.xml

2. Also the Shib SP will discard any scoped attribtues with non-matching
scope.

To make the SP accept scoped attributes in both private.com and
home.private.com these need to be listed as shibmd:Scope extensions in
the SAML metadata describing the IDP.

-peter