Two Scopes in Metadata

[Peter Schober]

* Kevin Ratcliffe <kratcliffe at bolton-sfc.ac.uk> [2016-01-21 14:59]:
> Staff at our college have username at bolton-sfc.ac.uk and students
> have username at office365.bolton-sfc.ac.uk as their email
> addresses. With the only scope in my metadata being
> bolton-sfc.ac.uk, students EPPNs are created and filtered correctly
> by my test IDP but are discarded by my test SP, presumably because
> office365.bolton-sfc.ac.uk is not defined as a scope in my IDP
> metadata.

That's precisely the reason. You're issuing scoped attributes from an
IDP that's not known to be "authorised" to issue/assert those.

> So I was just wondering which is more desirable, either having EPPNs
> which are not equal to the username or having multiple scopes
> defined in IDP metadata? Sorry if my original question was posed
> incorrectly.

Are you saying people subjects need to enter their full email address
or ePPN during login ("ePPN ... equal to the username")?
Of course the primary concern is not breaking anything and not causing
change for people.
So changing what people need to enter is out of the question.
And changing ePPNs will break access to federated resources for people
having uses those resouces in the past, where those resources rely on
ePPN to identify a subject.
So we're back to the "3" (2 really) options I mentioned before, I think.
-peter