<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Feb 20, 2014 at 4:50 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">* Zico <<a href="mailto:mailzico@gmail.com">mailzico@gmail.com</a>> [2014-02-20 11:32]:<br>
<div class="">> Lately I am facing an interesting situation. I am trying to pass three<br>
> types of ePSA values from my IDP. 1. <a href="mailto:manager@private.com">manager@private.com</a> 2.<br>
> <a href="mailto:manager@home.private.com">manager@home.private.com</a>. 3. <a href="mailto:staff@private.com">staff@private.com</a>.<br>
<br>
</div>1. Because the Shibboleth SP by default enforces the used attributes<br>
definition, see "Permissible values" in<br>
<a href="http://macedir.org/specs/eduperson/#eduPersonAffiliation" target="_blank">http://macedir.org/specs/eduperson/#eduPersonAffiliation</a><br>
<br>
To make the SP accept other values you'd need to adapt the<br>
"eduPersonAffiliationValues" rule in the SP's attribute-policy.xml<br>
<br>
2. Also the Shib SP will discard any scoped attribtues with non-matching<br>
scope.<br>
<br>
To make the SP accept scoped attributes in both <a href="http://private.com" target="_blank">private.com</a> and<br>
<a href="http://home.private.com" target="_blank">home.private.com</a> these need to be listed as shibmd:Scope extensions in<br>
the SAML metadata describing the IDP.<br></blockquote><div><br><br></div><div>Thanks for your tip, Peter. I made the changes in my IDP metadata with multiple shibdmd:Scopes ( ** ). But, still nothing changing... <br><br>
( ** ) <br><i><br><Extensions><br> <shibmd:Scope regexp="false"><a href="http://private.com">private.com</a></shibmd:Scope><br> <shibmd:Scope regexp="false"><a href="http://home.private.com">home.private.com</a></shibmd:Scope><br>
</Extensions><br><br></i><br></div><div>Should I move for #1 steps you specified as well in SP? <br></div><div><br></div><div>Thanks in advance! <br><br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br><br clear="all"><br>-- <br>Best,<br>Zico
</div></div>