<div dir="ltr">Thanks Nate and Peter - that /Session URL did indeed match up with what $_SERVER gave me.<div><br></div><div>The userPrincipalName comes from an AD attribute and includes the domain/scope already. Looking at this page:</div><div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/PrescopedAttributeDefinition">https://wiki.shibboleth.net/confluence/display/IDP30/PrescopedAttributeDefinition</a> </div><div>I can't see how to define a scope as a parameter (I tried scope="@<a href="http://hull-college.ac.uk">hull-college.ac.uk</a>" as an attribute of the definition, to no avail).<br></div><div><br></div><div>A post I found via google led me to attribute-policy on the SP side, so I modified the scope on on ScopedRules there to be @<a href="http://hull-college.ac.uk">hull-college.ac.uk</a>, and restarted the SP. But it still didn't work.</div><div><br></div><div>I'm thinking it's better to understand and get it work rather than take the shortcut of just redefining it on both sides as an unscoped attribute.</div><div><br></div><div><br></div><div>Thanks,<br>Dave</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 14, 2019 at 5:12 PM Nate Klingenstein <<a href="mailto:ndk@signet.id" target="_blank">ndk@signet.id</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Dave,<br>
<br>
Right here:<br>
<br>
> 2019-05-14 17:02:15 DEBUG Shibboleth.AttributeFilter [1] [default]: applying filtering rule(s) for attribute (eppn) from (<a href="https://shibb.hull-college.ac.uk/idp/shibboleth" rel="noreferrer" target="_blank">https://shibb.hull-college.ac.uk/idp/shibboleth</a> <<a href="https://shibb.hull-college.ac.uk/idp/shibboleth" rel="noreferrer" target="_blank">https://shibb.hull-college.ac.uk/idp/shibboleth</a>>)<br>
> <br>
> 2019-05-14 17:02:15 WARN Shibboleth.AttributeFilter [1] [default]: removed value at position (0) of attribute (eppn) from (<a href="https://shibb.hull-college.ac.uk/idp/shibboleth" rel="noreferrer" target="_blank">https://shibb.hull-college.ac.uk/idp/shibboleth</a> <<a href="https://shibb.hull-college.ac.uk/idp/shibboleth" rel="noreferrer" target="_blank">https://shibb.hull-college.ac.uk/idp/shibboleth</a>>)<br>
<br>
Your problem is that the scope that is associated with this eppn is not one that is considered valid for the IdP <a href="https://shibb.hull-college.ac.uk/idp/shibboleth" rel="noreferrer" target="_blank">https://shibb.hull-college.ac.uk/idp/shibboleth</a>, so the SP is discarding it.  You'll need to empower your IdP to express that scope, or in the case the scope happens to be a typo, rectify that.<br>
<br>
Best wishes,<br>
Nate.<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>