<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style>
<!--
@font-face
{font-family:Helvetica}
@font-face
{font-family:Wingdings}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
p.MsoListNumber, li.MsoListNumber, div.MsoListNumber
{margin-top:0cm;
margin-right:0cm;
margin-bottom:6.0pt;
margin-left:36.0pt;
text-indent:0cm;
font-size:10.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p
{margin-right:0cm;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
p.error, li.error, div.error
{margin-right:0cm;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
span.StileMessaggioDiPostaElettronica20
{font-family:"Calibri","sans-serif";
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:70.85pt 2.0cm 2.0cm 2.0cm}
ol
{margin-bottom:0cm}
ul
{margin-bottom:0cm}
-->
</style><style type="text/css" id="owaParaStyle"></style>
</head>
<body lang="IT" link="blue" vlink="purple" fpstyle="1" ocsi="0">
<span style="font-family: Helvetica; ">Mauro,</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">Resending this because I don't think the first edition got through. The formatting got a little screwed up as I switched to sending through the Office 365 Outlook interface, but I hope this will both be legible and delivered...</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<blockquote type="cite" style="font-family: Helvetica; ">Actually, I followed this guide <a href="http://www.microsoft.com/en-us/download/details.aspx?id=35464">http://www.microsoft.com/en-us/download/details.aspx?id=35464</a> that on page 47 says<br>
</blockquote>
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">Fascinating. This guide looks like it overlaps a lot with, but is completely distinct from:</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<a href="http://technet.microsoft.com/en-us/library/jj205456" style="font-family: Helvetica; ">http://technet.microsoft.com/en-us/library/jj205456</a><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<blockquote type="cite" style="font-family: Helvetica; ">c. Leave What scope will the IdP assert ? empty<br>
<br>
</blockquote>
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">This will usually cause issues and I'm surprised it's in the documentation. Jean-Marie, one of the authors, knows his stuff, so I'll be curious to find out why this was written.</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<blockquote type="cite" style="font-family: Helvetica; ">I will inform the authors, however I left an empty scope because I didn’t want that some users were filtered out.<br>
</blockquote>
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">I'm not sure what you mean by users being filtered out. The scope entered in that dialog is used to automagically append domains to some attributes in a default configuration(e.g. using uid to build an EPPN) and is also
used to generate the example metadata.</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">My suspicion is that they never planned on using the metadata generated by the IdP and they were going to store attributes with a scope in the upstream data source. I still don't think that entering a scope would hurt
anything, though.</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<blockquote type="cite" style="font-family: Helvetica; ">In fact, even though my AD domain name is “shibbo-domain.local”, I defined AD users like <a href="mailto:john.smith@eduteamit.net">john.smith@eduteamit.net</a> and<a href="mailto:paul.brown@otherdomain.com">paul.brown@otherdomain.com</a> and
so I didn’t know what to write there, during Shibboleth installation. I probably misunderstood the point, but I supposed that my users’ domain should match the scope I write there, shound’t it?<br>
</blockquote>
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">Yes, it should, and I think you understand. The scope validation is used to ensure that the IdP is authoritative over the attribute values it asserts. This prevents, for example, </span><a href="http://idp.osu.edu/" style="font-family: Helvetica; ">idp.osu.edu</a><span style="font-family: Helvetica; "> from
asserting </span><a href="mailto:ndk@internet2.edu" style="font-family: Helvetica; ">ndk@internet2.edu</a><span style="font-family: Helvetica; ">.</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<blockquote type="cite" style="font-family: Helvetica; ">Another QQ: where could I find the error you reported (Scope must have TextContent)? I could find only the other generic error “unable to locate metadata for provider”.<br>
</blockquote>
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">It will register complaints about metadata validation failures during startup of the SP. At runtime, it has no way of knowing that this entityID was defined in an unparseable file, so it just reports that it can't locate
metadata for that provider.</span><br style="font-family: Helvetica; ">
<br style="font-family: Helvetica; ">
<blockquote type="cite" style="font-family: Helvetica; ">Thank you so much,<br>
</blockquote>
<br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">Glad to help.</span><br style="font-family: Helvetica; ">
<span style="font-family: Helvetica; ">Nate.</span>
</body>
</html>