Handling Scope for AD as an IdP to linux shibboleth SPs

[Cantor, Scott]

> The issue or question is not whether the attribute values
> being sent contain a scope (i.e., they're always
> foo at example.edu) but about the fact that the attribute used
> (we don't know which one, yet) is known by the Shib SP
> software to be defined as "scoped" and hence scope
> checking against the shibmd:Scope metadata extension is
> performed.

Of course that's ultimately a semantic distinction made by whoever configures the SP, you can apply the rule to any attribute provided it's decoded as Scoped.

We didn't define mail that way because of how we expected mail to be used, but a MS principal name is probably something one should define that way, and the way mail is abused by many SPs is such that scoping it is probably also correct in a lot of cases.

What matters is understanding why we did it and what the threat is, and I would have thought MS being bitten by giant impersonation breaks in their platform might have communicated that more widely.

Your point about self-asserting it is on point of course, though the world believes metadata obtained over https is inviolate and so inherently trustworthy at least in so far as they think the right entity owns the URL to start with.

-- Scott