<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi Alan, Scott, <div class=""><br class=""></div><div class="">Thanks for both of your responses which indeed helped me debug the problem. It turned out at the SP attribute-policy.xml the scope filtering was the cause. </div><div class=""><br class=""></div><div class="">The relevant section of attribute-policy.xml of the SP.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><afp:PermitValueRule id="ScopingRules" xsi:type="AND"><br class=""> <Rule xsi:type="NOT"><br class=""> <Rule xsi:type="AttributeValueRegex" regex="@"/><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span></Rule><br class=""> <Rule xsi:type="saml:AttributeScopeMatchesShibMDScope"/><br class=""> </afp:PermitValueRule></div><div class=""><br class=""></div><div class=""> <afp:AttributeRule attributeID="subject-id"> --><br class=""> <!-- <afp:PermitValueRuleReference ref="ScopingRules"/> —></div><div class=""> <!-- </afp:AttributeRule> --><br class=""><br class=""><div class=""><b class="">When I comment out to drop scope checking rule for "subject-id” then I get the attribute all right. </b></div><div class=""><br class=""></div><div class="">Please note that the “<a href="http://test.org" class="">test.org</a>” in my earlier email was just a mistaken entry in the email. When I actually use the correct scope string or even %{idp.scope}, the above attribute-policy at the SP is dropping the attribute. </div><div class=""><br class=""></div><div class=""><resolver:AttributeDefinition id="subject-id" xsi:type="ad:Scoped" scope=“%{idp.scope}" sourceAttributeID="computedID"><br class=""> <resolver:Dependency ref="computedID" /><br class=""> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oasis:names:tc:SAML:attribute:subject-id" friendlyName="subject-id" encodeType="false" /><br class=""> </resolver:AttributeDefinition></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thanks, </div><div class=""><br class=""></div><div class=""><br class="">---<br class="">Satya Mohapatra | ସତ୍ୟ ମହାପାତ୍ର | सत्य महापात्र | ستیا موہپترا</div><div class=""><br class=""></div><div class=""><br class=""><blockquote type="cite" class="">On Jan 16, 2020, at 9:09 AM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:<br class=""><br class="">On 1/15/20, 11:14 PM, "users on behalf of Satya Mohapatra" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:patra@mit.edu" class="">patra@mit.edu</a>> wrote:<br class=""><blockquote type="cite" class="">Any suggestion what I could be doing wrong ?<br class=""></blockquote><br class="">Probably not including <a href="http://test.org" class="">test.org</a> in a Scope extension in the IdP's metadata.<br class=""><br class="">—</blockquote><blockquote type="cite" class="">Scott<br class=""><br class=""></blockquote><div class=""><br class=""></div><blockquote type="cite" class="">On Jan 16, 2020, at 5:24 AM, Alan Buxey <<a href="mailto:alan.buxey@myunidays.com" class="">alan.buxey@myunidays.com</a>> wrote:<br class=""></blockquote><blockquote type="cite" class="">hi,<br class=""><br class=""><blockquote type="cite" class="">WARN Shibboleth.AttributeFilter [1] [default]: removed value at position (0) of attribute (subject-id) from (<a href="https://login-test.ligo.org/idp/shibboleth" class="">https://login-test.ligo.org/idp/shibboleth</a>)<br class="">WARN Shibboleth.AttributeFilter [1] [default]: no values left, removing attribute (subject-id) from (https://login-test.ligo.org/idp/shibboleth)<br class=""></blockquote><br class="">is that ALL its saying? no mention above that top line about applying<br class="">filtering rule?<br class=""><br class=""><blockquote type="cite" class="">The attribute map at the SP has the following:<br class=""><Attribute name="urn:oasis:names:tc:SAML:attribute:subject-id" id="subject-id”/><br class=""></blockquote><br class=""><br class="">is that all? no attribute decoder specified?<br class=""><br class=""><br class="">I would run a login session with SAMLTracer plugin being used so you<br class="">can see what messages and values are being sent through (format etc).<br class=""><br class="">alan</blockquote><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></div></body></html>