Attribute Filters using DefaultRelyingParty

[Jeffrey Crawford]

We recently switched from using relying party lists to allow access to our
IdP to filtering the metadata and using the DefaultRelyingParty entry to
accept all SP's that we have valid metadata for.

However we noticed that for entity id's were we didn't have a relying party
entry, but were allowed to login because they were caught in the
DefaultRelyingParty, the filters we defined stopped working if we used
the AttributeRequesterString in the AttributeFilterPolicy.

However by disabling the DefaultRelyingParty and setting up a relying party
group for InCommon (using urn:mace:incommon). Then the filters picked up
again.

Is there a reason why AttributeFilterPolicys AttributeRequesterString would
ignore the entity ID and not apply filters if using DefaultRelyingParty as
opposed to RelyingParty.

Note that the IdP allowed the login but simply didn't send the attributes
defined.

Jeffrey
C.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140331/f7ad3ecd/attachment.html