<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1427810646006_3632" dir="ltr"><span>The scope is set like this in their MD:</span></div><div id="yui_3_16_0_1_1427810646006_3632" dir="ltr"><span><br></span></div><div id="yui_3_16_0_1_1427810646006_3632" dir="ltr"><span id="yui_3_16_0_1_1427810646006_3639"> <shibmd:Scope regexp="true">(.*\.|)fanshawec.ca</shibmd:Scope><br></span></div> <div id="yui_3_16_0_1_1427810646006_3632" dir="ltr" class="" style=""><br></div><br><div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Tuesday, March 31, 2015 6:49 AM, Mike Flynn <shibbolethlynda@yahoo.com> wrote:<br> </font> </div> <br><br> <div class="y_msg_container"><div id="yiv9326624218"><div><div style="color:#000;background-color:#fff;font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px;"><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr">Howdy.</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr">I run Shibboleth SP on windows. Version is 2.3.1</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr">I have a couple of IDPs telling me that we are dropping some of their scoped affiliation values. So, here is what I am seeing.</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr">First off, the attribute-policy file has never been changed on my system. It is still running with the default rules:</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><br class="yiv9326624218" style=""></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><afp:AttributeFilterPolicyGroup</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> xmlns:afp="urn:mace:shibboleth:2.0:afp"</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><br class="yiv9326624218" style=""></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <!-- Shared rule for affiliation values. --></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRule id="eduPersonAffiliationValues" xsi:type="OR"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="faculty"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="student"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="staff"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="alum"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="member"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="affiliate"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="employee"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="emeritus"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="facstaff"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueString" value="library-walk-in"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:PermitValueRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <!--</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> Shared rule for all "scoped" attributes, but you'll have to manually apply it inside</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> an AttributeRule for each attribute you want to check.</div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> --></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRule id="ScopingRules" xsi:type="AND"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="NOT"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="AttributeValueRegex" regex="@"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </Rule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope" xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:PermitValueRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><br class="yiv9326624218" style=""></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:AttributeFilterPolicy></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <!-- This policy is in effect in all cases. --></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PolicyRequirementRule xsi:type="ANY"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><br class="yiv9326624218" style=""></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <!-- Filter out undefined affiliations and ensure only one primary. --></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:AttributeRule attributeID="affiliation"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRule xsi:type="AND"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <RuleReference ref="eduPersonAffiliationValues"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <RuleReference ref="ScopingRules"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:PermitValueRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:AttributeRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:AttributeRule attributeID="unscoped-affiliation"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:AttributeRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:AttributeRule attributeID="primary-affiliation"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:AttributeRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><span class="yiv9326624218" style="white-space:pre;"> </span></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:AttributeRule attributeID="eppn"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRuleReference ref="ScopingRules"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:AttributeRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><br class="yiv9326624218" style=""></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:AttributeRule attributeID="targeted-id"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRuleReference ref="ScopingRules"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:AttributeRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <!-- Catch-all that passes everything else through unmolested. --></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:AttributeRule attributeID="*"></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> <afp:PermitValueRule xsi:type="ANY"/></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:AttributeRule></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </afp:AttributeFilterPolicy></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""><br class="yiv9326624218" style=""></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""></afp:AttributeFilterPolicyGroup></div><div class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3120"><br class="yiv9326624218" style=""></div><div class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3121"><br></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122">Looking at an assertion I see this:</div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122"><br></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122"><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122" style=""><br class="yiv9326624218" style=""></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122" style=""><saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*member@supportstaff.fanshawec.ca*</saml2:AttributeValue></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*staff@fanshawec.ca*</saml2:AttributeValue></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*staff@supportstaff.fanshawec.ca*</saml2:AttributeValue></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*member@fanshawec.ca*</saml2:AttributeValue></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3122" style=""> </saml2:Attribute></div><div class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3157"><br class="yiv9326624218" style=""></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3158">But on the session page I see this:</div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3159"><br></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160"><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3198">SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol</b></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3199">Authentication Time: 2015-01-20T16:14:56.713Z</b></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3200">Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</b></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3201">Authentication Context Decl: (none)</b></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3202">Session Expiration (barring inactivity): 476 minute(s)</b></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style=""><br class="yiv9326624218" style=""></b></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style="">Attributes</b></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160" style=""><b class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3203">affiliation: *staff@fanshawec.ca;member@fanshawec.ca*</b></div><div class="yiv9326624218" style="" id="yiv9326624218yui_3_16_0_1_1427808182144_3204"><br class="yiv9326624218" style=""></div></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3160"><br class="yiv9326624218" style=""></div></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123">And in my logs I see this:</div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123"><br></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123"><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123" style="">2015-01-30 09:50:54 WARN Shibboleth.AttributeFilter [2052]: removed value at position (2) of attribute (affiliation) from (https://login.fanshawec.ca/idp/shibboleth)</div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123" style=""><br></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123" style="">Why is this happening?</div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123" style=""><br></div><div class="yiv9326624218" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3123" style="">Thanks!</div></div><div class="yiv9326624218" style="" dir="ltr" id="yiv9326624218yui_3_16_0_1_1427808182144_3128"><br></div><div id="yiv9326624218yui_3_16_0_1_1427808182144_2884" dir="ltr" class="yiv9326624218" style=""> </div></div></div></div><br><br></div> </div> </div> </div></div></body></html>