Unexpected reproducible behavior of PermitValue rule of type ScopeRegex in Shibboleth SP 3.4.1

[Rod Widdowson]

So...
           <PermitValueRule xsi:type="ScopeRegex" regex="^.*\.edu$" />
Matches

                <saml:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                                     xsi:type="xsd:string"
                                     >mailto:FLORIAN.LENGYEL94 at login.puny.edu</saml:AttributeValue>

But
           <PermitValueRule xsi:type="ScopeRegex" regex="^.*login\.puny\.edu$" />
Doesn't

Note that the attribute is being send as a string so your decoder is converting it into a scoped attribute and so you are comparing
the SCOPE

	login.puny.edu

against
	^.*\.edu$
Which matches

And against 
	^.*login\.puny\.edu$
Which doesn't

Seems to me that you need to drop the .* 

	Rod

> This was how I spent the New Year holiday—it does not compute.
Been there, done that:

	"A person has a problem, they say 'I'll use a regexp', they now have two problems"