affiliation values dropping

[Mike Flynn]

Howdy.
I run Shibboleth SP on windows.  Version is 2.3.1
I have a couple of IDPs telling me that we are dropping some of their scoped affiliation values.  So, here is what I am seeing.
First off, the attribute-policy file has never been changed on my system.  It is still running with the default rules:

<afp:AttributeFilterPolicyGroup    xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"    xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"    xmlns:afp="urn:mace:shibboleth:2.0:afp"    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <!-- Shared rule for affiliation values. -->    <afp:PermitValueRule id="eduPersonAffiliationValues" xsi:type="OR">        <Rule xsi:type="AttributeValueString" value="faculty"/>        <Rule xsi:type="AttributeValueString" value="student"/>        <Rule xsi:type="AttributeValueString" value="staff"/>        <Rule xsi:type="AttributeValueString" value="alum"/>        <Rule xsi:type="AttributeValueString" value="member"/>        <Rule xsi:type="AttributeValueString" value="affiliate"/>        <Rule xsi:type="AttributeValueString" value="employee"/>        <Rule xsi:type="AttributeValueString" value="emeritus"/>        <Rule xsi:type="AttributeValueString" value="facstaff"/>        <Rule xsi:type="AttributeValueString" value="library-walk-in"/>    </afp:PermitValueRule>        <!--    Shared rule for all "scoped" attributes, but you'll have to manually apply it inside    an AttributeRule for each attribute you want to check.    -->    <afp:PermitValueRule id="ScopingRules" xsi:type="AND">        <Rule xsi:type="NOT">            <Rule xsi:type="AttributeValueRegex" regex="@"/>        </Rule>        <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope" xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"/>    </afp:PermitValueRule>
    <afp:AttributeFilterPolicy>        <!-- This policy is in effect in all cases. -->        <afp:PolicyRequirementRule xsi:type="ANY"/>
        <!-- Filter out undefined affiliations and ensure only one primary. -->        <afp:AttributeRule attributeID="affiliation">            <afp:PermitValueRule xsi:type="AND">                <RuleReference ref="eduPersonAffiliationValues"/>                <RuleReference ref="ScopingRules"/>            </afp:PermitValueRule>        </afp:AttributeRule>        <afp:AttributeRule attributeID="unscoped-affiliation">            <afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/>        </afp:AttributeRule>        <afp:AttributeRule attributeID="primary-affiliation">            <afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/>        </afp:AttributeRule>         <afp:AttributeRule attributeID="eppn">            <afp:PermitValueRuleReference ref="ScopingRules"/>        </afp:AttributeRule>
        <afp:AttributeRule attributeID="targeted-id">            <afp:PermitValueRuleReference ref="ScopingRules"/>        </afp:AttributeRule>                <!-- Catch-all that passes everything else through unmolested. -->        <afp:AttributeRule attributeID="*">            <afp:PermitValueRule xsi:type="ANY"/>        </afp:AttributeRule>            </afp:AttributeFilterPolicy>
</afp:AttributeFilterPolicyGroup>

Looking at an assertion I see this:

<saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">         <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*member at supportstaff.fanshawec.ca*</saml2:AttributeValue>         <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*staff at fanshawec.ca*</saml2:AttributeValue>         <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*staff at supportstaff.fanshawec.ca*</saml2:AttributeValue>         <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*member at fanshawec.ca*</saml2:AttributeValue>      </saml2:Attribute>
But on the session page I see this:
SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocolAuthentication Time: 2015-01-20T16:14:56.713ZAuthentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:unspecifiedAuthentication Context Decl: (none)Session Expiration (barring inactivity): 476 minute(s)
Attributesaffiliation: *staff at fanshawec.ca;member at fanshawec.ca*

And in my logs I see this:
2015-01-30 09:50:54 WARN Shibboleth.AttributeFilter [2052]: removed value at position (2) of attribute (affiliation) from (https://login.fanshawec.ca/idp/shibboleth)
Why is this happening?
Thanks!
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150331/e17f268b/attachment-0001.html