ScopeMatchesShibMDScope question

[Cantor, Scott]

> would this be permitted and let through the filtering if orgAffiliation 
> (It is a scoped variable) contains "baba at yaga@1234567890"?

The SP has a policy rule in its default file:

    <!--
    Shared rule for all "scoped" attributes, but you'll have to manually apply it inside
    an AttributeRule for each attribute you want to check.
    -->
    <PermitValueRule id="ScopingRules" xsi:type="AND">
        <Rule xsi:type="NOT">
            <Rule xsi:type="ValueRegex" regex="@"/>
        </Rule>
        <Rule xsi:type="ScopeMatchesShibMDScope"/>
    </PermitValueRule>

That’s how it blocks illegal constructs like that.

-- Scott