<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <font size="-1"><font size="-1"><font size="-1"><font size="-1"><font
              size="-1"></font></font></font></font>My SP install came
      with the follow<font size="-1">in<font size="-1">g</font>:<br>
        <br>
        <font size="-1">&nbsp;&nbsp;&nbsp; &lt;<a class="moz-txt-link-freetext" href="afp:PermitValueRule">afp:PermitValueRule</a> id="ScopingRules"
          xsi:type="AND"&gt;<br>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Rule xsi:type="NOT"&gt;<br>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Rule xsi:type="AttributeValueRegex"
          regex="@"/&gt;<br>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/Rule&gt;<br>
          &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;Rule
          xsi:type="saml:AttributeScopeMatchesShibMDScope"/&gt;<br>
          &nbsp;&nbsp;&nbsp; &lt;/<a class="moz-txt-link-freetext" href="afp:PermitValueRule">afp:PermitValueRule</a>&gt;<br>
          <br>
          <font size="-1">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;<a class="moz-txt-link-freetext" href="afp:AttributeRule">afp:AttributeRule</a>
            attributeID="eppn"&gt;<br>
            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;<a class="moz-txt-link-freetext" href="afp:PermitValueRuleReference">afp:PermitValueRuleReference</a>
            ref="ScopingRules"/&gt;<br>
            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/<a class="moz-txt-link-freetext" href="afp:AttributeRule">afp:AttributeRule</a>&gt;<br>
          </font><br>
        </font><br>
        I'm trying to accept <font size="-1">eppn and other v<font
            size="-1">alues from our IdP and another IdP<font size="-1">
              but for some reason this </font></font></font>Attrib<font
          size="-1">uteRule <font size="-1">is preventing the SP f<font
              size="-1">rom accepting e<font size="-1">ppn from <font
                  size="-1">the other IdP. If I change that Rul<font
                    size="-1">eReference to &lt;<a class="moz-txt-link-freetext" href="afp:PermitValueRule">afp:PermitValueRule</a>
                    xsi:type="ANY"/&gt;, then the eppn comes thro<font
                      size="-1">ugh (as one would <font size="-1">expect.<br>
                        <br>
                        How <font size="-1">do I <font size="-1">correctly
                            filter e<font size="-1">ppn, and similar
                              attributes?</font></font></font><br>
                        <br>
                        <font size="-1">I think I don't und<font
                            size="-1">erstand the <font size="-1">Scoping<font
                                size="-1">Rules<font size="-1">. It
                                  seems to me to say that the filter <font
                                    size="-1">matches if the va<font
                                      size="-1">lue <font size="-1">does
                                        not match "@" and has attribute
                                        s<font size="-1">cope <font
                                            size="-1">matching the
                                            metadata scope.<br>
                                            <br>
                                            <font size="-1"><font
                                                size="-1">I though<font
                                                  size="-1">t scope was
                                                  repres<font size="-1">ented
                                                    as <font size="-1">"<font
                                                        size="-1">value@<font
                                                          size="-1">scop<font
                                                          size="-1">e"
                                                          so <font
                                                          size="-1">any
                                                          scoped
                                                          attribute w<font
                                                          size="-1">ou<font
                                                          size="-1">ld
                                                          faile the
                                                          above test.<br>
                                                          <font
                                                          size="-1">Which
                                                          MD<font
                                                          size="-1">Scope
                                                          must the
                                                          AttributeScope
                                                          match? The MD<font
                                                          size="-1">Scope
                                                          <font
                                                          size="-1">of
                                                          the Id<font
                                                          size="-1">P
                                                          making the
                                                          assertion or
                                                          the MDScope <font
                                                          size="-1">of
                                                          the SP<font
                                                          size="-1">
                                                          receiving the
                                                          assertion?</font></font></font></font></font></font></font><br>
                                                          </font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font></font><br>
    <font size="-1"><font size="-1"><font size="-1">Totally not sure
          where to look for th<font size="-1">e following<font size="-1">
              in the wiki. <font size="-1">The doc<font size="-1">s on
                  this look a little spar<font size="-1">se. Can I help?</font></font></font></font></font></font><br>
        <br>
      </font></font>
    <div class="moz-signature">
      <div id="signature-separator" style="line-height:5px; color:
        #888;">--&nbsp;</div>
      <div id="sig" style="margin: 6px 0; padding: 8px; border-top: 1px
        #000 dashed; font: 12px/15px Tahoma, Geneva, sans-serif;
        color:#be0f34;"> <img src="http://goo.gl/2ZYiQ" alt="me"
          moz-do-not-send="true" style="float:left; padding: 2px 6px 0
          0;" border="0" height="43" width="43"> <span style="color:
          black;">Don Faulkner, CISSP</span> | <span><a
            onmouseover="this.style.textDecoration = 'underline'"
            onmouseout="this.style.textDecoration = 'none'"
            style="color:#be0f34; text-decoration:none;"
            href="http://its.uark.edu/">IT Security</a> at the <a
            onmouseover="this.style.textDecoration = 'underline'"
            onmouseout="this.style.textDecoration = 'none'"
            style="color:#be0f34; text-decoration:none;"
            href="http://www.uark.edu/">University of Arkansas</a></span>
        <br>
        <span style="font-family: Monaco, Lucida Sans Typewriter,
          monospace; color: black;">contact&gt;&gt; </span><span
          style=""><a onmouseover="this.style.textDecoration =
            'underline'" onmouseout="this.style.textDecoration = 'none'"
            style="color:#be0f34; text-decoration:none;"
            href="mailto:donf@uark.edu">donf@uark.edu</a> | +1 (479)
          575-2905</span> <br>
        <span style="font-family: Monaco, Lucida Sans Typewriter,
          monospace; color: black;">connect&gt;&gt; </span><span
          style=""><a onmouseover="this.style.textDecoration =
            'underline'" onmouseout="this.style.textDecoration = 'none'"
            style="color:#be0f34; text-decoration:none;"
            href="http://www.facebook.com/uarkITS">uarkITS on Facebook</a>
          | <a onmouseover="this.style.textDecoration = 'underline'"
            onmouseout="this.style.textDecoration = 'none'"
            style="color:#be0f34; text-decoration:none;"
            href="http://twitter.com/uaits">@uaits</a> | <a
            onmouseover="this.style.textDecoration = 'underline'"
            onmouseout="this.style.textDecoration = 'none'"
            style="color:#be0f34; text-decoration:none;"
            href="http://twitter.com/dfaulkner">@dfaulkner</a> </span>
      </div>
    </div>
  </body>
</html>