ScopeMatchesShibMDScope question

[Cantor, Scott]

The IdP's SAML decoder for scoped attributes detects the first instance of the delmiter, splits there, and then the scope (containing the extra one) wouldn't pass a metadata scope check.

The SP might do the same, but the policy rule was there very far back, might not even be needed these days, but it's a good documentation aid anyway.

I will let you do the math on what most non-Shibboleth software might do with stuff like this and what the implications might be.

-- Scott