Troubleshooting a data release issue for InCommon and RandS

[Cooper, Robert A]

Howdy!
I am currently trying to troubleshoot a data release issue between my university and NSF/research.gov.  From what I have gathered, we are not the only institution having this issue.

What it comes down to is that an individual who selects to use InCommon for their research.gov login, ends up not getting both the InCommon attributes released, but the IdP is also matching on our Research and Scholarship (RandS) attribute policy.  The policies both release an attribute that matches the OID for mail, one as 'mail' and the other as 'email'.  At some point these attributes are getting merged to give mail multiple values, which is breaking the authentication flow at research.gov.

These are our filter policies for each:
<AttributeFilterPolicy id="InCommonFederationDefaultRelease">
    <PolicyRequirementRule xsi:type="OR">
        <Rule xsi:type="InEntityGroup" groupID="urn:mace:incommon" />
        <Rule xsi:type="EntityAttributeExactMatch"
         attributeName="source_of_metadata"
        attributeValue="incommon-mdq"/>
    </PolicyRequirementRule>


<AttributeFilterPolicy id="releaseToRandSBundle">
    <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
             attributeName="http://macedir.org/entity-category"
             attributeValue="http://refeds.org/category/research-and-scholarship" />

I fixed a similiar issue last year for another entity by creating an explicit deny rule for the email attribute, but I'd like to figure out a more general solution that doesn't require tacking on each entityID as we come across the broken ones.  Has anyone else experienced this, or have any suggestions that might provide a fix?

Thanks,
RobertC

--
Robert A. Cooper | Senior Lead Infrastructure Systems Engineer
Infrastructure Systems Operations | Technology Services
Texas A&M University
1368 TAMU | College Station, TX 77843-1368
ph: 979-862-1262 | racooper at tamu.edu
IT.tamu.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250807/7e81a315/attachment.htm>