<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://265/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Mauro,<div><br></div><div><div><blockquote type="cite"><div lang="IT" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Actually, I followed this guide<span class="Apple-converted-space"> </span><a href="http://www.microsoft.com/en-us/download/details.aspx?id=35464" style="color: purple; text-decoration: underline; ">http://www.microsoft.com/en-us/download/details.aspx?id=35464</a><span class="Apple-converted-space"> </span>that on page 47 says</span></div></div></div></blockquote><div><br></div><div>Fascinating. This guide looks like it overlaps a lot with, but is completely distinct from:</div><div><br></div><div><a href="http://technet.microsoft.com/en-us/library/jj205456">http://technet.microsoft.com/en-us/library/jj205456</a></div><br><blockquote type="cite"><div lang="IT" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "><o:p></o:p></span></div><p class="MsoListNumber" style="margin: 0cm 0cm 6pt 70.9pt; font-size: 10pt; font-family: Calibri, sans-serif; text-indent: -21.25pt; text-align: justify; "><span lang="EN-US" style="font-size: 10pt; text-indent: -21.25pt; ">c.<span style="font-size: 7pt; font-family: 'Times New Roman'; "> </span></span><span lang="EN-US" style="font-size: 10pt; text-indent: -21.25pt; ">Leave <b>What scope will the IdP assert ? </b>empty</span></p></div></div></blockquote><div><br></div><div>This will usually cause issues and I'm surprised it's in the documentation. Jean-Marie, one of the authors, knows his stuff, so I'll be curious to find out why this was written.</div><div><br></div><blockquote type="cite"><div lang="IT" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 11pt; ">I will inform the authors, however I left an empty scope because I didn’t want that some users were filtered out.</span></div></div></div></blockquote><div><br></div><div>I'm not sure what you mean by users being filtered out. The scope entered in that dialog is used to automagically append domains to some attributes in a default configuration(e.g. using uid to build an EPPN) and is also used to generate the example metadata.</div><div><br></div><div>My suspicion is that they never planned on using the metadata generated by the IdP and they were going to store attributes with a scope in the upstream data source. I still don't think that entering a scope would hurt anything, though.</div><br><blockquote type="cite"><div lang="IT" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 11pt; ">In fact, even though my AD domain name is “shibbo-domain.local”, I defined AD users like</span> <a href="mailto:john.smith@eduteamit.net" style="font-family: Calibri, sans-serif; font-size: 11pt; color: purple; ">john.smith@eduteamit.net</a> <span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 11pt; "> and</span> <a href="mailto:paul.brown@otherdomain.com" style="font-family: Calibri, sans-serif; font-size: 11pt; color: purple; ">paul.brown@otherdomain.com</a> <span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 11pt; ">and so I didn’t know what to write there, during Shibboleth installation. I probably misunderstood the point, but I supposed that my users’ domain should match the scope I write there, shound’t it?</span></div></div></div></blockquote><div><br></div><div>Yes, it should, and I think you understand. The scope validation is used to ensure that the IdP is authoritative over the attribute values it asserts. This prevents, for example, <a href="http://idp.osu.edu">idp.osu.edu</a> from asserting <a href="mailto:ndk@internet2.edu">ndk@internet2.edu</a>.</div><br><blockquote type="cite"><div lang="IT" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Another QQ: where could I find the error you reported (</span><span style="font-size: 12pt; ">Scope must have TextContent</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">)? I could find only the other generic error “</span><span style="font-size: 10pt; font-family: 'Courier New'; ">unable to locate metadata for provider</span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">”.</span></div></div></div></blockquote><div><br></div><div>It will register complaints about metadata validation failures during startup of the SP. At runtime, it has no way of knowing that this entityID was defined in an unparseable file, so it just reports that it can't locate metadata for that provider.</div><br><blockquote type="cite"><div lang="IT" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="color: rgb(31, 73, 125); font-family: Calibri, sans-serif; font-size: 11pt; ">Thank you so much,</span></div></div></div></blockquote><br></div><div>Glad to help.</div>Nate.</div></body></html>