<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im">> What exactly in the metadata would enable that?<br>
<br>
</div><shibmd:Scope regexp="false"><a href="http://example.org" target="_blank">example.org</a></shibmd:Scope><br>
<br>
See also attribute-policy.xml in the SP's config directory.<br></blockquote><div><br></div><div style>Thanks Peter. If I'm understanding this right, adding <font face="courier new, monospace">shibmd:Scope</font> has no effect by itself, but needs to be combined with one or more <font face="courier new, monospace">Rule</font>s with <font face="courier new, monospace">xsi:type="saml:AttributeScopeMatchesShibMDScope"</font> in <font face="courier new, monospace">attribute-policy.xml</font>. Is that right?</div>
<div style><br></div><div style>Moreover, since metadata is typically provided by the IdP, doesn't this amount to the IdP self-asserting what values it's allowed to send?<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im"><br>
> > You could also rely on the NameID construct and its qualifiers and do<br>
> > filtering based on that, along with having flexibility in how you serialize<br>
> > the NameID structure into an identifier to consume.<br>
><br>
> Other than scope, what qualifiers of NameID would be relevant here?<br>
<br>
</div>NameIDs are not scoped (in the sense that eduPersonScopedAffiliation<br>
is), they are 3-tuples: IdP identifier, SP identifiers, subject<br>
identifier. The wiki has lots more info on NameIdentifiers.<br></blockquote><div><br></div><div style>Okay, from my reading of the spec I understand that both <font face="courier new, monospace">NameQualifier</font> and <font face="courier new, monospace">SPNameQualifier</font> are optional. I also get the impression that they are rarely used—that is, I don't believe I have ever seem them used either in examples/documentation, or “in the wild.”</div>
<div style><br></div><div style>Is there a way for an SP to indicate that it requires them, either via metadata or in an <font face="courier new, monospace">AuthnRequest</font>?</div><div style><br></div><div style>And the way to filter based on that would be to use a <font face="courier new, monospace">PermitValueRule</font> with <font face="courier new, monospace">xsi:type="saml:NameIDQualifierString"</font>, is that right? With the expectation that they will correspond with the IdP <font face="courier new, monospace">entityID</font> and the SP <font face="courier new, monospace">entityID</font> respectively?<br clear="all">
<div><br></div>-- <br>Best regards,<br><br>Robert Lowe<br><a href="http://notability.rmlowe.com/" target="_blank">http://notability.rmlowe.com/</a>
<p></p>
</div></div></div></div>