Scoped attributes available to other definitions?

[Baron Fujimoto]

I'm trying to kludge around a limitation of one of our service providers[*].

I've attempting to construct an email attribute from a previously defined
scoped attribute, but the resulting email attribute value only contains
the unscoped value. Using these configs, I get the resulting output below:

attribute-resolver.xml:
===
    <!-- aacli_scoped_principal -->
    <resolver:AttributeDefinition xsi:type="ad:Scoped"
            id="aacli_scoped_principal"
            scope="hawaii.edu">

        <resolver:Dependency ref="principal" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString"
                name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9"
                friendlyName="aacli_scoped_principal" />

    </resolver:AttributeDefinition>
    <!-- /aacli_scoped_principal -->

    <!-- aacli_kludge_email -->
    <resolver:AttributeDefinition xsi:type="ad:Simple"
            id="aacli_kludge_email">

        <resolver:Dependency ref="aacli_scoped_principal" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
                name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="kludge_mail" />

    </resolver:AttributeDefinition>
    <!-- /aacli_kludge_email -->
===

attribute-filter.xml:
===
    <!-- aacli_test -->
    <afp:AttributeFilterPolicy id="aacli_test">

        <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString"
                value="aacli_test" />

        <afp:AttributeRule attributeID="aacli_scoped_principal">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

        <afp:AttributeRule attributeID="aacli_kludge_email">
            <afp:PermitValueRule xsi:type="basic:ANY" />
        </afp:AttributeRule>

    </afp:AttributeFilterPolicy>
    <!-- /aacli_test -->
===

bin/aacli.sh --configDir=conf --principal=baron --requester=aacli_test
===
<?xml version="1.0" encoding="UTF-8"?><saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
   <saml2:Attribute FriendlyName="kludge_mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
      <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">baron</saml2:AttributeValue>
   </saml2:Attribute>
   <saml2:Attribute FriendlyName="aacli_scoped_principal" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
      <saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">baron at hawaii.edu</saml2:AttributeValue>
   </saml2:Attribute>
</saml2:AttributeStatement>
===

Is there a way to get the fully scoped value of "aacli_scoped_principal"
into "aacli_kludge_email"?

[*] The service provider is "SANS Securing the Human"
<http://www.securingthehuman.org/> which currently assumes that "mail"
is not a potentially multivalued attribute. I need to ensure that they
only get a predictable, single value for this attribute when provided
to them. Basing it off of the principal seemed like good solution in
this situation.

-baron
-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum