<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hello:<o:p></o:p></p><p class=MsoNormal>I am trying to control which attributes are released in a response from an unsolicited SSO flow. The following attribute policy is being used:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> <afp:AttributeFilterPolicy id="releaseToKrames"><o:p></o:p></p><p class=MsoNormal> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://kod.musc.edu" /><o:p></o:p></p><p class=MsoNormal> <afp:AttributeRule attributeID="UserName"><o:p></o:p></p><p class=MsoNormal> <afp:PermitValueRule xsi:type="basic:ANY"/><o:p></o:p></p><p class=MsoNormal> </afp:AttributeRule><o:p></o:p></p><p class=MsoNormal> <afp:AttributeRule attributeID="AccountName"><o:p></o:p></p><p class=MsoNormal> <afp:PermitValueRule xsi:type="basic:ANY"/><o:p></o:p></p><p class=MsoNormal> </afp:AttributeRule><o:p></o:p></p><p class=MsoNormal> </afp:AttributeFilterPolicy><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The flow is being tested by calling the unsolicited SSO URL in the IdP along with the providerId="https://kod.musc.edu". Instead of only releasing the 2 attributes above, my IdP is releasing all of the attributes that are mapped in my generic “basic:ANY” policy, and sent to the location of the AssertionConsumerService in my metadata.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Is it possible to setup an AttributeFilterPolicy based on the value of the providerID from an unsolicited SSO? My thought was the providerID would translate into the value of the AttributeRequesterString in the AttributeFilterPolicy, but that doesn’t appear to be the case. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any insight would be greatly appreciated!<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.25in'><span style='font-size:9.0pt;font-family:"Georgia","serif"'>Rob Castellow<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in'><span style='font-size:9.0pt;font-family:"Georgia","serif"'>Systems Engineer<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in'><span style='font-size:9.0pt;font-family:"Georgia","serif"'>IAS, OCIO<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.25in'><i><span style='font-size:9.0pt;font-family:"Georgia","serif"'>Medical University of South Carolina<o:p></o:p></span></i></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>