eliminating warnings for unscoped attributes

[Peter Schober]

* csross <cross at hccs.com> [2016-01-20 18:32]:
> I have been researching and checking other posts but I want to understand
> what to tell the IDP to change to eliminate the error.  I don't see these
> warnings for other IDPs.  I believe/think the warning means that since it
> was not a scoped attribute (@site.com), shibboleth dropped it?  

No. The name of the attribute is an unscoped affiliation, so the Shib
SP would not throw that away if it was unscoped. i.e., would match the
specification. Scopes have nothing to do with it.

> SHIBD WARN
> 2016-01-19 14:59:22 WARN Shibboleth.AttributeFilter [2]: removed value at
> position (0) of attribute (unscoped-affiliation) from
> (http://site.site.edu/simplesaml-coi/saml2/idp/metadata.php)
> 2016-01-19 14:59:22 WARN Shibboleth.AttributeFilter [2]: no values left,
> removing attribute (unscoped-affiliation) from
> (http://site.site.edu/simplesaml-coi/saml2/idp/metadata.php)
> 
> I see in my attribute.map the unscoped-affiliation entry, and I believe the
> shibd.log entry (below) shows that field coming over.  I know there are lots
> of posts but I don’t definitely know what to suggest to the client in order
> to eliminate it.  Is it as simple as saying “don’t send that attribute”?  I
> see they are sending many unmapped attributes that are not generating
> warnings.

As the log says the SP is removing the value, the reason for this is:

> <saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue
> xsi:type="xs:string">Consultant</saml:AttributeValue></saml:Attribute>

that the eduPersonAffiliation attribute is specified
http://macedir.org/specs/eduperson/#eduPersonAffiliation
with currently 8 legal ("permissible") values:
"faculty, student, staff, alum, member, affiliate, employee,
library-walk-in".

You will find those same values in your Shib SP's attribute-policy.xml
in the first PermitValueRule element with id="eduPersonAffiliationValues".

As "Consultant" is not among those the default configuration of the
software throws it out.
If you wanted to accept the non-standard value you'd have to extend
the list of values in your attribute-policy.xml config file.
Otherwise you can continue letting the software remove other values or
try talking to the IDP to not send those in the first place.
-peter