<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font size="-1"><font size="-1"><font size="-1"><font size="-1"><font
size="-1"></font></font></font></font>My SP install came
with the follow<font size="-1">in<font size="-1">g</font>:<br>
<br>
<font size="-1"> <<a class="moz-txt-link-freetext" href="afp:PermitValueRule">afp:PermitValueRule</a> id="ScopingRules"
xsi:type="AND"><br>
<Rule xsi:type="NOT"><br>
<Rule xsi:type="AttributeValueRegex"
regex="@"/><br>
</Rule><br>
<Rule
xsi:type="saml:AttributeScopeMatchesShibMDScope"/><br>
</<a class="moz-txt-link-freetext" href="afp:PermitValueRule">afp:PermitValueRule</a>><br>
<br>
<font size="-1"> <<a class="moz-txt-link-freetext" href="afp:AttributeRule">afp:AttributeRule</a>
attributeID="eppn"><br>
<<a class="moz-txt-link-freetext" href="afp:PermitValueRuleReference">afp:PermitValueRuleReference</a>
ref="ScopingRules"/><br>
</<a class="moz-txt-link-freetext" href="afp:AttributeRule">afp:AttributeRule</a>><br>
</font><br>
</font><br>
I'm trying to accept <font size="-1">eppn and other v<font
size="-1">alues from our IdP and another IdP<font size="-1">
but for some reason this </font></font></font>Attrib<font
size="-1">uteRule <font size="-1">is preventing the SP f<font
size="-1">rom accepting e<font size="-1">ppn from <font
size="-1">the other IdP. If I change that Rul<font
size="-1">eReference to <<a class="moz-txt-link-freetext" href="afp:PermitValueRule">afp:PermitValueRule</a>
xsi:type="ANY"/>, then the eppn comes thro<font
size="-1">ugh (as one would <font size="-1">expect.<br>
<br>
How <font size="-1">do I <font size="-1">correctly
filter e<font size="-1">ppn, and similar
attributes?</font></font></font><br>
<br>
<font size="-1">I think I don't und<font
size="-1">erstand the <font size="-1">Scoping<font
size="-1">Rules<font size="-1">. It
seems to me to say that the filter <font
size="-1">matches if the va<font
size="-1">lue <font size="-1">does
not match "@" and has attribute
s<font size="-1">cope <font
size="-1">matching the
metadata scope.<br>
<br>
<font size="-1"><font
size="-1">I though<font
size="-1">t scope was
repres<font size="-1">ented
as <font size="-1">"<font
size="-1">value@<font
size="-1">scop<font
size="-1">e"
so <font
size="-1">any
scoped
attribute w<font
size="-1">ou<font
size="-1">ld
faile the
above test.<br>
<font
size="-1">Which
MD<font
size="-1">Scope
must the
AttributeScope
match? The MD<font
size="-1">Scope
<font
size="-1">of
the Id<font
size="-1">P
making the
assertion or
the MDScope <font
size="-1">of
the SP<font
size="-1">
receiving the
assertion?</font></font></font></font></font></font></font><br>
</font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font><br>
<font size="-1"><font size="-1"><font size="-1">Totally not sure
where to look for th<font size="-1">e following<font size="-1">
in the wiki. <font size="-1">The doc<font size="-1">s on
this look a little spar<font size="-1">se. Can I help?</font></font></font></font></font></font><br>
<br>
</font></font>
<div class="moz-signature">
<div id="signature-separator" style="line-height:5px; color:
#888;">-- </div>
<div id="sig" style="margin: 6px 0; padding: 8px; border-top: 1px
#000 dashed; font: 12px/15px Tahoma, Geneva, sans-serif;
color:#be0f34;"> <img src="http://goo.gl/2ZYiQ" alt="me"
moz-do-not-send="true" style="float:left; padding: 2px 6px 0
0;" border="0" height="43" width="43"> <span style="color:
black;">Don Faulkner, CISSP</span> | <span><a
onmouseover="this.style.textDecoration = 'underline'"
onmouseout="this.style.textDecoration = 'none'"
style="color:#be0f34; text-decoration:none;"
href="http://its.uark.edu/">IT Security</a> at the <a
onmouseover="this.style.textDecoration = 'underline'"
onmouseout="this.style.textDecoration = 'none'"
style="color:#be0f34; text-decoration:none;"
href="http://www.uark.edu/">University of Arkansas</a></span>
<br>
<span style="font-family: Monaco, Lucida Sans Typewriter,
monospace; color: black;">contact>> </span><span
style=""><a onmouseover="this.style.textDecoration =
'underline'" onmouseout="this.style.textDecoration = 'none'"
style="color:#be0f34; text-decoration:none;"
href="mailto:donf@uark.edu">donf@uark.edu</a> | +1 (479)
575-2905</span> <br>
<span style="font-family: Monaco, Lucida Sans Typewriter,
monospace; color: black;">connect>> </span><span
style=""><a onmouseover="this.style.textDecoration =
'underline'" onmouseout="this.style.textDecoration = 'none'"
style="color:#be0f34; text-decoration:none;"
href="http://www.facebook.com/uarkITS">uarkITS on Facebook</a>
| <a onmouseover="this.style.textDecoration = 'underline'"
onmouseout="this.style.textDecoration = 'none'"
style="color:#be0f34; text-decoration:none;"
href="http://twitter.com/uaits">@uaits</a> | <a
onmouseover="this.style.textDecoration = 'underline'"
onmouseout="this.style.textDecoration = 'none'"
style="color:#be0f34; text-decoration:none;"
href="http://twitter.com/dfaulkner">@dfaulkner</a> </span>
</div>
</div>
</body>
</html>