<div dir="ltr"><div><div>Thanks for all your help, I finally figured out what was going on.<br><br>My definition for eduPersonScopedAffiliation is below <br> <resolver:AttributeDefinition xsi:type="ad:Scoped" id="<wbr>eduPersonScopedAffiliation" scope="%{idp.scope}" sourceAttributeID="<wbr>eduPersonAffiliation"><br> <resolver:Dependency ref="myLDAP" /><br> <resolver:AttributeEncoder xsi:type="enc:<wbr>SAML1ScopedString" name="urn:mace:dir:attribute-<wbr>def:<wbr>eduPersonScopedAffiliation" encodeType="false" /><br> <resolver:AttributeEncoder xsi:type="enc:<wbr>SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.<wbr>5923.1.1.1.9" friendlyName="<wbr>eduPersonScopedAffiliation" encodeType="false" /><br> </resolver:<wbr>AttributeDefinition><br><br></div><div>While I was trying to understand the function of scope I was completely overlooking that eduPersonScopedAffiliation was defined by eduPersonAffiliation. I was confusing eduPersonAffiliation which we don't populate with eduPersonPrimayAffiliation which we do. Once I realized that it was trying to combine my scope, which does exist, with eduPersonAffiliation which does not, it was creating a NULL value.<br><br></div><div>I changed the above definition to make the sourceAttributeID="eduPersonPrimaryAffiliation" and now it works.<br><br></div><div>Thanks<br></div><div>-Bob<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 21, 2018 at 10:29 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> I guess I'm confused on the idea of scope, I can't find a clear definition of it,<br>
> all the docs I read assume you know what that is.<br>
<br>
</span>Basically, if I can assert your users' identifiers to a service...there's a potential problem.<br>
<br>
A scope is a qualifier for an identifier that makes it unique only within that namespace and is conventionally part of the identifier value, usually with an email-like/DNS-like syntax, but not exclusively.<br>
<br>
Federation requires namespace awareness of identifiers, and scoping is a way of doing that that can be semi-automated by third party federations if the software supports the concept and if they publish metadata that can authorize an IdP to assert data within particular scopes, which is what the Shibboleth software (by way of me) invented and developed a metadata extension to capture. It is supported essentially nowhere other than higher ed federation and the software we build.<br>
<br>
A Shibboleth SP defaults to processing specifically scoped attributes defined in higher ed in this way. It does not do this for attributes other than those defined in this way.<br>
<br>
If you're not operating in the context of a federation like InCommon or others, then none of this generally applies and you probably have to deal with the problem in other ways, are using email addresses as an identifier, or have gaping security holes in your services, or all three.<br>
<span class=""><br>
> Is scope something I'm<br>
> matching on?<br>
<br>
</span>An SP aware of scoped attributes matches on it for policy/filtering.<br>
<br>
> Would I put <a href="http://testshib.org" rel="noreferrer" target="_blank">testshib.org</a> <<a href="http://testshib.org" rel="noreferrer" target="_blank">http://testshib.org</a>> there if I wanted<br>
> that attribute to be delivered to <a href="http://testshib.org" rel="noreferrer" target="_blank">testshib.org</a> <<a href="http://testshib.org" rel="noreferrer" target="_blank">http://testshib.org</a>> ? <br>
<br>
That would be backwards, as I hope the explanation suggests, testshib is the SP so it consumes the data.<br>
<span class=""><br>
> Or is it<br>
> something else? In my definition I have scope="%{idp.scope}", is this a wild card?<br>
<br>
</span>That's a property replacement expression.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/SpringConfiguration" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/display/IDP30/<wbr>SpringConfiguration</a><br>
<br>
The IdP property for the scope is something that doesn't have a good natural home in the documentation due it's somewhat odd heritage. It's sort of an attribute resolver thing, but I don't recall where it's actually documented.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div></div>