saml proxying scoped attributes...best practice

[Bobby Lawrence]

Hello - I'm setting up a v5.1.3 IdP to allow proxying to other InCommon IdPs in addition to handling local password authentication.  I've got everything working, but I'm trying to figure out how to handle scoped attributes, mainly eduPersonPrincipalName (EPPN).  For the most part, it seems like the InCommon community has "standardized" on using eduPersonPrincipalName as the user identifier but I'm not entirely sure how to handle this in a proxy scenario.  I can fetch it from the subject but whenever its gets sent back to the downstream SP, the value is scoped to my IdP and the downstream SP ends up seeing a value something like this:  <uid>@<upstream_idp_scope>@<shib_idp_scope>.
Unfortunately this ends up being invalid on the SP side because it effectively thinks the scope is anything after the first '@'.  The shibd.log shows stuff like this:

2024-11-07 18:08:33 WARN Shibboleth.AttributeFilter [1] [default]: attribute (eppn) invalid scope (<upstream_idp_scope>@< shib_idp_scope>)
2024-11-07 18:08:33 WARN Shibboleth.AttributeFilter [1] [default]: removed value at position (0) of attribute (eppn) from (<idp_entity_id>)
2024-11-07 18:08:33 WARN Shibboleth.AttributeFilter [1] [default]: no values left, removing attribute (eppn) from (<idp_entity_id>)

So I guess my question is this...how should I be handling EPPN that comes back from the upstream IdP?  I'd like to send it downstream unmolested to the SP, which means I'd actually like to NOT apply the IdP scope, but I DO want to apply that scope for the non-proxying scenarios like when I build it via the password principal.
I know I can't have it both ways without some unique config, I just don't know what to do.

Should I transcode the upstream EPPN into a different attribute so that its not scoped?   If so, what would I send downstream as the EPPN?  Maybe resolve the EPPN with a scripted definition and manually apply the IdP scope if the input value isn't already scoped?  I'm sure that others have run into this situation before so I'm looking for some guidance...

Thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241108/20895052/attachment.htm>