<div dir="ltr">That's great! Thank you so much guys. </div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Mar 5, 2020 at 10:48 AM Yeargan, Yancey <<a href="mailto:Yancey.Yeargan@untsystem.edu">Yancey.Yeargan@untsystem.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div style="overflow-wrap: break-word;">
Those are the same "scopes" (which typically match DNS domains) that you use for the eduPersonScopedAffiliation attribute.
<div><br>
</div>
<div>For example, we have one IdP that handles multiple universities.</div>
<div><br>
</div>
<div>We have the following scopes: <a href="http://unt.edu" target="_blank">unt.edu</a>, <a href="http://untdallas.edu" target="_blank">untdallas.edu</a>, <a href="http://unthsc.edu" target="_blank">unthsc.edu</a>.</div>
<div><br>
</div>
<div>Our eduPersonScopedAffiliation attribute may return values like the following:</div>
<div><br>
</div>
<div><a href="mailto:student@unt.edu" target="_blank">student@unt.edu</a></div>
<div><a href="mailto:staff@untdallas.edu" target="_blank">staff@untdallas.edu</a></div>
<div><a href="mailto:staff@unthsc.edu" target="_blank">staff@unthsc.edu</a></div>
<div><a href="mailto:faculty@untdallas.edu" target="_blank">faculty@untdallas.edu</a></div>
<div><br>
</div>
<div><br>
</div>
<div>The "Scope" XML element (which may be repeated multiple times) in the extensions section of the IdP metadata lists scopes for which the IdP is authoritative. In other words, it says which scopes are owned by the IdP.</div>
<div><br>
</div>
<div>If the IdP is authoritative for scopes <a href="http://unt.edu" target="_blank">unt.edu</a>, <a href="http://unthsc.edu" target="_blank">unthsc.edu</a>, and <a href="http://untdallas.edu" target="_blank">untdallas.edu</a>, but sends an eduPersonScopedAffiliation value of <a href="mailto:student@mit.edu" target="_blank">student@mit.edu</a>, that is clearly wrong and the SP should ignore the incorrectly
scoped value. The Shibboleth SP does ignore incorrectly scoped values.</div>
<div><br>
</div>
<div>
<div>I hope that helps to explain the concept of scopes.</div>
<div><br>
</div>
</div>
<div>Yancey Yeargan</div>
<div>University of North Texas System</div>
<div><br>
</div>
<div><br>
<div>
<blockquote type="cite">
<div>On Mar 5, 2020, at 8:48 AM, Mohamed Lrhazi <<a href="mailto:lrhazi@cua.edu" target="_blank">lrhazi@cua.edu</a>> wrote:</div>
<br>
<div>
<div dir="ltr">Hello,
<div><br>
</div>
<div>I have setup our IdP for a couple of years now, and have been happily adding new SPs every now and then, and everyone is happy :)</div>
<div><br>
</div>
<div>Today am trying to add an SP and they complain that our metadata has this example section in it:</div>
<div><br>
</div>
<div><EntityDescriptor....<br>
</div>
<div><IDPSSODescriptor...<br>
</div>
<div> <Extensions><br>
<shibmd:Scope regexp="false"><a href="https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fexample.org%2F&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cc6e801e3b87d4462c9a408d7c1146450%7C70de199207c6480fa318a1afcba03983%7C0%7C1%7C637190165637626301&sdata=dRHWQky7svlJPl0E8xBX%2FIT71e37kiCsaHx%2BUIPJylM%3D&reserved=0" target="_blank">example.org</a></shibmd:Scope><br>
</div>
<div><br>
</div>
<div></Extensions><br>
</div>
<div>...</div>
<div><br>
</div>
<div>I obviously left the example from the sample metadata file... and never got to learn about scopes at all....</div>
<div><br>
</div>
<div>Anyone has a link to some high level document I could read to figure what would the implications be if I were to: try and fix this... Can I just remove the Extensions/ Scope element from my IdP metadata, or should I change the scope to be one
of our DNS domain names, what should my scope be? and do I need to have one at all? I guess maybe mine has been
<a href="https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fexample.org%2F&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cc6e801e3b87d4462c9a408d7c1146450%7C70de199207c6480fa318a1afcba03983%7C0%7C1%7C637190165637636291&sdata=Phi%2BIenKc4iv36KKW6Eb1YytDcaypa3vYi3HaLLl15s%3D&reserved=0" target="_blank">
example.org</a> all these years! is that bad? :)</div>
<div><br>
</div>
<div>Thanks a lot,</div>
<div>Mohamed.</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cc6e801e3b87d4462c9a408d7c1146450%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C637190165637656279&sdata=lyqPKmG5HH8%2F3JF9WmKqYSyECS0nTdoU6P69wO6LDcw%3D&reserved=0" target="_blank">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=02%7C01%7CYancey.Yeargan%40untsystem.edu%7Cc6e801e3b87d4462c9a408d7c1146450%7C70de199207c6480fa318a1afcba03983%7C0%7C0%7C637190165637656279&sdata=lyqPKmG5HH8%2F3JF9WmKqYSyECS0nTdoU6P69wO6LDcw%3D&reserved=0</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>