Handling Scope for AD as an IdP to linux shibboleth SPs

[Peter Schober]

Alan Buxey via users <users at shibboleth.net> [2025-01-29 13:49 CET]:
> for internal-only and non-global federated, you might get away with not
> doing scope checks - however, some attributes are supposed to have a
> scope..so if the IdP is releasing values expected to have scope then
> that'll be more work.
> for those with scope requirements its because at a globally available SP
> you HAVE to have scope or else jane.smith from Purdue University cannot be
> distinguished from janet.smith from University of Sydney or jane.smith from
> Uppsala Universitet

The issue or question is not whether the attribute values being sent
contain a scope (i.e., they're always foo at example.edu) but about the
fact that the attribute used (we don't know which one, yet) is known
by the Shib SP software to be defined as "scoped" and hence scope
checking against the shibmd:Scope metadata extension is performed.
Which will fail (causing the SP to drop any violating values) when the
metadata describing the IDP that asserted those values does not
include that metadata extension.

-peter