<div dir="ltr">Ah, well that sounds easy. Thanks Steve!<div><br></div><div>Jason</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Nov 12, 2021 at 11:03 AM Mak, Steve <<a href="mailto:makst@upenn.edu">makst@upenn.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US" style="overflow-wrap: break-word;">
<div class="gmail-m_1208140841223936078WordSection1">
<p class="MsoNormal">You can make a new filter policy just for that SP and set a deny rule on eduPersonScopedAffiliation. Deny rules always win.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12pt;color:black">From: </span></b><span style="font-size:12pt;color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Jason Rotunno <<a href="mailto:jrotunno@swarthmore.edu" target="_blank">jrotunno@swarthmore.edu</a>><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Friday, November 12, 2021 at 11:01 AM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>Help with Specific Attribute Filter<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Hey All,<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">We're running Shibboleth IdP 4.0.1 and have an attribute filter to release a set of core attributes to InCommon members:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<blockquote style="margin-left:30pt;margin-right:0in">
<div>
<p class="MsoNormal"><!-- Attribute release for all InCommon SPs --><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><AttributeFilterPolicy id="releaseToInCommon"> <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <PolicyRequirementRule xsi:type="EntityAttributeExactMatch"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> attributeName="<a href="https://urldefense.com/v3/__http:/macedir.org/entity-category__;!!IBzWLUs!C1_TXp1E72lGzoj5JEZUiCuW6FAg9rdwyUb7lM-x_3jFmBNhnvXgmLo9OKR5pA$" target="_blank">http://macedir.org/entity-category</a>"<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> attributeValue="<a href="https://urldefense.com/v3/__http:/id.incommon.org/category/registered-by-incommon__;!!IBzWLUs!C1_TXp1E72lGzoj5JEZUiCuW6FAg9rdwyUb7lM-x_3jFmBNhnvXgmLp5-Y-UWg$" target="_blank">http://id.incommon.org/category/registered-by-incommon</a>"/><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="eduPersonPrincipalName"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="eduPersonScopedAffiliation"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="givenName"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="surname"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="displayName"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <AttributeRule attributeID="email"><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> <PermitValueRule xsi:type="ANY" /><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"> </AttributeRule><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"></AttributeFilterPolicy><u></u><u></u></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">There's a particular InCommon SP for which we have to omit sending the eduPersonScopedAffiliation attribute and I haven't been able to figure out how to do that. Does anyone have an idea of how to achieve this?<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Jason<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<pre>Jason Rotunno<u></u><u></u></pre>
<pre>System & Security Administrator<u></u><u></u></pre>
<pre>Swarthmore College<u></u><u></u></pre>
<pre>500 College Ave<u></u><u></u></pre>
<pre>Swarthmore, PA 19081<u></u><u></u></pre>
<pre>610.328.8505<u></u><u></u></pre>
<pre><b>VERIFY before you click!!</b><u></u><u></u></pre>
<pre> - Attackers make their emails look like they come from someone they don't.<u></u><u></u></pre>
<pre> - Attackers make links look like they go to websites they don't.<u></u><u></u></pre>
<pre> - Attackers disguise malware as receipts, invoices, faxes, etc.<u></u><u></u></pre>
<pre>Forward suspicious emails to <a href="mailto:phishing@swarthmore.edu" target="_blank"><span style="font-family:Arial,sans-serif">phishing@swarthmore.edu</span></a><span style="font-family:Arial,sans-serif">.</span><u></u><u></u></pre>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><pre cols="72">Jason Rotunno
System & Security Administrator
Swarthmore College
500 College Ave
Swarthmore, PA 19081
610.328.8505<br></pre><pre cols="72"><b>VERIFY before you click!!</b>
- Attackers make their emails look like they come from someone they don't.
- Attackers make links look like they go to websites they don't.
- Attackers disguise malware as receipts, invoices, faxes, etc.</pre><pre cols="72">Forward suspicious emails to <a href="mailto:phishing@swarthmore.edu" style="font-family:Arial,Helvetica,sans-serif" target="_blank">phishing@swarthmore.edu</a><span style="font-family:Arial,Helvetica,sans-serif">.</span></pre></div></div></div></div></div></div></div></div></div></div></div></div>