Two Scopes in Metadata

[Kevin Ratcliffe]

Hi Tom

Thanks for your reply.

What I'm trying to achieve is to make all users EPPN the same as their email address as per the comments in attribute-resolver.xml.

Staff at our college have username at bolton-sfc.ac.uk and students have username at office365.bolton-sfc.ac.uk as their email addresses. With the only scope in my metadata being bolton-sfc.ac.uk, students EPPNs are created and filtered correctly by my test IDP but are discarded by my test SP, presumably because office365.bolton-sfc.ac.uk is not defined as a scope in my IDP metadata. So I was just wondering which is more desirable, either having EPPNs which are not equal to the username or having multiple scopes defined in IDP metadata? Sorry if my original question was posed incorrectly.

Kevin Ratcliffe
Network & IT Systems Support
Bolton Sixth Form College
T: 01204 846215
E: kratcliffe at bolton-sfc.ac.uk
W: www.bolton-sfc.ac.uk
Save Paper. Please consider the environment before printing.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
Sent: 21 January 2016 13:04
To: Shib Users <users at shibboleth.net>
Subject: Re: Two Scopes in Metadata

On Thu, Jan 21, 2016 at 6:33 AM, Kevin Ratcliffe <kratcliffe at bolton-sfc.ac.uk> wrote:
>
> I am currently setting up a v3 IDP and after reading the comments in attribute-resolver.xml, it says to 'consider making the EPPN value the same as your official email addresses whenever possible'. Previously I'd made everyone's EPPN the same format although not the same as their email addresses although globally unique. We have students on MS Office365 with a different email suffix. Is my case a valid reason to have two scopes in my metadata?

No, I don't think so, not from what you've said so far. Scopes only apply to scoped attributes (like ePPN). The recommendation to align your ePPN with your email address is orthogonal to the scope question.

Tom
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

This email has been scanned by BSFC and seems to be OK