Missing Attributes

[Cantor, Scott]

>     I guess I'm confused on the idea of scope, I can't find a clear definition of it,
> all the docs I read assume you know what that is.

Basically, if I can assert your users' identifiers to a service...there's a potential problem.

A scope is a qualifier for an identifier that makes it unique only within that namespace and is conventionally part of the identifier value, usually with an email-like/DNS-like syntax, but not exclusively.

Federation requires namespace awareness of identifiers, and scoping is a way of doing that that can be semi-automated by third party federations if the software supports the concept and if they publish metadata that can authorize an IdP to assert data within particular scopes, which is what the Shibboleth software (by way of me) invented and developed a metadata extension to capture. It is supported essentially nowhere other than higher ed federation and the software we build.

A Shibboleth SP defaults to processing specifically scoped attributes defined in higher ed in this way. It does not do this for attributes other than those defined in this way.

If you're not operating in the context of a federation like InCommon or others, then none of this generally applies and you probably have to deal with the problem in other ways, are using email addresses as an identifier, or have gaping security holes in your services, or all three.

> Is scope something I'm
> matching on?

An SP aware of scoped attributes matches on it for policy/filtering.

>  Would I put testshib.org <http://testshib.org>  there if I wanted
> that attribute to be delivered to testshib.org <http://testshib.org> ? 

That would be backwards, as I hope the explanation suggests, testshib is the SP so it consumes the data.

> Or is it
> something else?  In my definition I have scope="%{idp.scope}", is this a wild card?

That's a property replacement expression.

https://wiki.shibboleth.net/confluence/display/IDP30/SpringConfiguration

The IdP property for the scope is something that doesn't have a good natural home in the documentation due it's somewhat odd heritage. It's sort of an attribute resolver thing, but I don't recall where it's actually documented.

-- Scott