Unexpected reproducible behavior of PermitValue rule of type ScopeRegex in Shibboleth SP 3.4.1

[Florian Lengyel]

>So...
>           <PermitValueRule xsi:type="ScopeRegex" regex="^.*\.edu$" /> Matches

No, it does not match 
                
                     >mailto:FLORIAN.LENGYEL94 at login.puny.edu</saml:AttributeValue>

That's the point!

>But
>          <PermitValueRule xsi:type="ScopeRegex" regex="^.*login\.puny\.edu$" /> Doesn't

Yes it does.

>Note that the attribute is being send as a string so your decoder is converting it into a scoped attribute and so you are comparing the SCOPE

>        login.puny.edu

Exactly. I noted this many times before sending to the list.


>against
>        ^.*\.edu$
>Which matches 

No it doesn't. It's a genuine bug.

>And against
>        ^.*login\.puny\.edu$
>Which doesn't

No that more restrictive regex matches.

This violates regex101.com. 


>       Rod


Happy New Year,
Florian