Handling Scope for AD as an IdP to linux shibboleth SPs

[Cantor, Scott]

> 2. bypass options for the SP to ignore the AD IdPs' scope
> check?

The SP policy language is a subset of the IdP's language so we never got around to trying to cover it separately.

The relevant IdP topic is https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199502580/ScopeMatchesShibMDScope

The rules you use are whatever you want them to be, notwithstanding that removing that one opens one up to trivial impersonation attacks. So the level of trust imparted in IdPs becomes much higher.

You can always bake in scope filtering rules explicitly without relying on metadata as well, the Scope policy rule does that directly and can be combined with Issuer rules to link them together.

>. shibboleth SP docs that give more details about working
> with AD IdPs?

The SP docs are a mess but given the total redesign coming it isn't realistic to expect any improvement in the old material at this point when it's all going to be radically changed.

-- Scott