<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr">Howdy.</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr">I run Shibboleth SP on windows. Version is 2.3.1</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr">I have a couple of IDPs telling me that we are dropping some of their scoped affiliation values. So, here is what I am seeing.</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr">First off, the attribute-policy file has never been changed on my system. It is still running with the default rules:</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr"><br></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><afp:AttributeFilterPolicyGroup</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> xmlns="urn:mace:shibboleth:2.0:afp:mf:basic"</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> xmlns:afp="urn:mace:shibboleth:2.0:afp"</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <!-- Shared rule for affiliation values. --></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRule id="eduPersonAffiliationValues" xsi:type="OR"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="faculty"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="student"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="staff"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="alum"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="member"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="affiliate"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="employee"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="emeritus"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="facstaff"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueString" value="library-walk-in"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:PermitValueRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <!--</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> Shared rule for all "scoped" attributes, but you'll have to manually apply it inside</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> an AttributeRule for each attribute you want to check.</div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> --></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRule id="ScopingRules" xsi:type="AND"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="NOT"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="AttributeValueRegex" regex="@"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </Rule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope" xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:PermitValueRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:AttributeFilterPolicy></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <!-- This policy is in effect in all cases. --></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PolicyRequirementRule xsi:type="ANY"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <!-- Filter out undefined affiliations and ensure only one primary. --></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:AttributeRule attributeID="affiliation"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRule xsi:type="AND"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <RuleReference ref="eduPersonAffiliationValues"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <RuleReference ref="ScopingRules"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:PermitValueRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:AttributeRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:AttributeRule attributeID="unscoped-affiliation"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:AttributeRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:AttributeRule attributeID="primary-affiliation"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRuleReference ref="eduPersonAffiliationValues"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:AttributeRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><span class="" style="white-space:pre"> </span></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:AttributeRule attributeID="eppn"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRuleReference ref="ScopingRules"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:AttributeRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:AttributeRule attributeID="targeted-id"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRuleReference ref="ScopingRules"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:AttributeRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <!-- Catch-all that passes everything else through unmolested. --></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:AttributeRule attributeID="*"></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> <afp:PermitValueRule xsi:type="ANY"/></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:AttributeRule></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </afp:AttributeFilterPolicy></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""><br class="" style=""></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""></afp:AttributeFilterPolicyGroup></div><div class="" style="" id="yui_3_16_0_1_1427808182144_3120"><br class="" style=""></div><div class="" style="" id="yui_3_16_0_1_1427808182144_3121"><br></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122">Looking at an assertion I see this:</div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122"><br></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122"><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122" style=""><br class="" style=""></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122" style=""><saml2:Attribute FriendlyName="eduPersonScopedAffiliation" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*member@supportstaff.fanshawec.ca*</saml2:AttributeValue></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*staff@fanshawec.ca*</saml2:AttributeValue></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*staff@supportstaff.fanshawec.ca*</saml2:AttributeValue></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122" style=""> <saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">*member@fanshawec.ca*</saml2:AttributeValue></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3122" style=""> </saml2:Attribute></div><div class="" style="" id="yui_3_16_0_1_1427808182144_3157"><br class="" style=""></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3158">But on the session page I see this:</div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3159"><br></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160"><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style="" id="yui_3_16_0_1_1427808182144_3198">SSO Protocol: urn:oasis:names:tc:SAML:2.0:protocol</b></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style="" id="yui_3_16_0_1_1427808182144_3199">Authentication Time: 2015-01-20T16:14:56.713Z</b></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style="" id="yui_3_16_0_1_1427808182144_3200">Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</b></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style="" id="yui_3_16_0_1_1427808182144_3201">Authentication Context Decl: (none)</b></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style="" id="yui_3_16_0_1_1427808182144_3202">Session Expiration (barring inactivity): 476 minute(s)</b></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style=""><br class="" style=""></b></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style="">Attributes</b></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160" style=""><b class="" style="" id="yui_3_16_0_1_1427808182144_3203">affiliation: *staff@fanshawec.ca;member@fanshawec.ca*</b></div><div class="" style="" id="yui_3_16_0_1_1427808182144_3204"><br class="" style=""></div></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3160"><br class="" style=""></div></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123">And in my logs I see this:</div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123"><br></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123"><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123" style="">2015-01-30 09:50:54 WARN Shibboleth.AttributeFilter [2052]: removed value at position (2) of attribute (affiliation) from (https://login.fanshawec.ca/idp/shibboleth)</div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123" style=""><br></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123" style="">Why is this happening?</div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123" style=""><br></div><div class="" dir="ltr" id="yui_3_16_0_1_1427808182144_3123" style="">Thanks!</div></div><div class="" style="" dir="ltr" id="yui_3_16_0_1_1427808182144_3128"><br></div><div id="yui_3_16_0_1_1427808182144_2884" dir="ltr" class="" style=""> </div></div></body></html>