SP not receiving all ePSA values from IDP

[Zico]

On Thu, Feb 20, 2014 at 4:50 AM, Peter Schober
<peter.schober at univie.ac.at>wrote:

> * Zico <mailzico at gmail.com> [2014-02-20 11:32]:
> > Lately I am facing an interesting situation. I am trying to pass three
> > types of ePSA values from my IDP. 1. manager at private.com 2.
> > manager at home.private.com. 3. staff at private.com.
>
> 1. Because the Shibboleth SP by default enforces the used attributes
> definition, see "Permissible values" in
> http://macedir.org/specs/eduperson/#eduPersonAffiliation
>
> To make the SP accept other values you'd need to adapt the
> "eduPersonAffiliationValues" rule in the SP's attribute-policy.xml
>
> 2. Also the Shib SP will discard any scoped attribtues with non-matching
> scope.
>
> To make the SP accept scoped attributes in both private.com and
> home.private.com these need to be listed as shibmd:Scope extensions in
> the SAML metadata describing the IDP.
>


Thanks for your tip, Peter. I made the changes in my IDP metadata with
multiple shibdmd:Scopes ( ** ). But, still nothing changing...

( ** )






*<Extensions>            <shibmd:Scope regexp="false">private.com
<http://private.com></shibmd:Scope>            <shibmd:Scope
regexp="false">home.private.com <http://home.private.com></shibmd:Scope>
 </Extensions>*
Should I move for #1 steps you specified as well in SP?

Thanks in advance!



> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Best,
Zico
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140220/a6c2fb0d/attachment.html