InCommon AttributeFilterPolicy PolicyRequirementRule?

[Baron Fujimoto]

Can anyone provide a pointer to the current recommended practice for an
AttributeFilterPolicy  PolicyRequirementRule for the InCommon Federation?
My searches at incommon.org and shibboleth.net have been unsuccessful.

The InCommon AttributeFilterPolicy for InCommon we have carried forward
over many upgrades is:

    <AttributeFilterPolicy id="InCommon_Federation">
        <PolicyRequirementRule xsi:type="AND">
                <Rule xsi:type="EntityAttributeExactMatch"
                        attributeName="http://macedir.org/entity-category"
                        attributeValue="
http://id.incommon.org/category/registered-by-incommon" />
                <Rule xsi:type="RegistrationAuthority"
                        registrars="https://incommon.org" />
        </PolicyRequirementRule>
        ...

Where I think we expect something like the following in the entity's InC
metadata:

  <Extensions>
    <mdrpi:RegistrationInfo
xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" registrationAuthority="
https://incommon.org"/>
    <mdattr:EntityAttributes
xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
      <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
Name="http://macedir.org/entity-category"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue>
http://id.incommon.org/category/registered-by-incommon</saml:AttributeValue>
      </saml:Attribute>
    </mdattr:EntityAttributes>
  </Extensions>

However, we have now encountered an SP (entityID="
https://login.offcampuspartners.com") that is in the InC metadata, but for
which these requirements are not present. I think this is the first time
we've encountered issues with these conditions. But maybe we should be
doing this differently now?

Any suggestions would be appreciated.
-- 
Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230428/16dc5605/attachment.htm>