<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>Thank you sir.</span></div><div><br></div> <div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> "Cantor, Scott" <cantor.2@osu.edu><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, September 27, 2012 8:44 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: passing eduPersonScopedAffiliation question.<br> </font> </div> <br>
On 9/27/12 11:26 AM, "Mike Flynn" <<a ymailto="mailto:shibbolethlynda@yahoo.com" href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:<br><br>>They supply their metadata to me via a URL:<br>><a href="https://idpstarid.mnscu.edu/idp/profile/Metadata/SAML" target="_blank">https://idpstarid.mnscu.edu/idp/profile/Metadata/SAML</a><br>><br>>Is there a simple change I can ask them to do on their side to fix this?<br><br>I don't know how they're producing their metadata. I'm just saying that<br>the simplest fix is for that metadata to include the extension. If they<br>get the metadata from some automated tool in a commercial product, then I<br>expect it's not so simple. If it's Shibboleth or the metadata's hand<br>generated, it should be straightforward to add it.<br><br>If you want to change your filter policy, you'd need to start by reading<br>the IdP documentation (SP uses the same filtering language more or
less)<br>and look at the existing filter file. If you understand the syntax and the<br>rules, you can change them.<br><br>The match function for basing policy on the IdP name is<br>AttributeIssuerString. If you take the existing policy that contains the<br>scoped attributes and change the ANY to a match on the entityID and wrap<br>that in a NOT then you have an exclusion for that IdP so the standard<br>rules don't run. Then you can create a separate policy applying to that<br>entityID alone, and you can stick in a rule that applies the<br>AttributeScopeString function checking for their scope.<br><br>-- Scott<br><br><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br> </div> </div> </div></body></html>