Replacing IdP-provided attributes with those returned by an attribute authority

[Matthew X. Economou]

I wrote:

> How do I ignore or filter out the IdP-provided attributes?  I want the
> VO-provided attributes to replace anything provided by the IdP.

Scott Koranda suggested I filter out everything from the IdP except for
ePPN or ePUID, so I replaced the existing attribute filter policy with
the following:

    <!--
        Only consume the ePPN provided by the IdP; ignore all other
        attributes.
    -->
    <afp:AttributeFilterPolicy>
        <afp:PolicyRequirementRule xsi:type="NOT">
            <basic:Rule
                xsi:type="basic:AttributeIssuerString"
                value="https://aa.example.org/aa/shibboleth" />
        </afp:PolicyRequirementRule>
        
        <afp:AttributeRule attributeID="eppn">
            <afp:PermitValueRuleReference ref="ScopingRules"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

    <!--
        Pass through all attributes provided by the VO.
    -->
    <afp:AttributeFilterPolicy>
        <afp:PolicyRequirementRule
            xsi:type="basic:AttributeIssuerString"
            value="https://aa.example.org/aa/shibboleth" />

        <afp:AttributeRule attributeID="*" permitAny="true"/>
    </afp:AttributeFilterPolicy>

Instead of issuing the VO-generated principal name as an ePPN, I'm going
to issue it as a UPN.

Best wishes,
Matthew

-- 
"The lyf so short, the craft so longe to lerne."