Multiple IdP servers and response validation

[Peter Schober]

* KajoKrtko <acojakochces at gmail.com> [2014-03-14 15:51]:
> My question is how can I prevent (or detect or validate) that
> customer/company AA is sending only values ending with
> @domainAA.org.  Basically to prevent a situation when company AA is
> trying to send attribute with value
> e.g. something at domainBB.org. Value which belongs to company BB, not
> AA.
> 
> Does shibboleth have some rules or something I can set up to prevent
> counterfeit domain beng sent? Maybe something like "response with this
> certificate can have only @domainAA.org domain" or something similar.

Yes, the default configuration does such checks for eduPerson[1]
attributes define as "scoped"[2] (mostly eduPersonPrincipalName,
eduPersonScopedAffiliation), against the shibmd:Scope extension from
the IDP's SAML metadata. Look at the SP's attribute-policy.xml for a
start.
-peter

[1] http://macedir.org/specs/eduperson/
[2] http://macedir.org/specs/eduperson/#Scope