<div dir="ltr">Can anyone provide a pointer to the current recommended practice for an AttributeFilterPolicy  PolicyRequirementRule for the InCommon Federation? My searches at <a href="http://incommon.org">incommon.org</a> and <a href="http://shibboleth.net">shibboleth.net</a> have been unsuccessful.<div><br></div><div>The InCommon AttributeFilterPolicy for InCommon we have carried forward over many upgrades is:</div><div><br></div><div>    <AttributeFilterPolicy id="InCommon_Federation"><br>        <PolicyRequirementRule xsi:type="AND"><br>                <Rule xsi:type="EntityAttributeExactMatch"<br>                        attributeName="<a href="http://macedir.org/entity-category">http://macedir.org/entity-category</a>"<br>                        attributeValue="<a href="http://id.incommon.org/category/registered-by-incommon">http://id.incommon.org/category/registered-by-incommon</a>" /><br>                <Rule xsi:type="RegistrationAuthority"<br>                        registrars="<a href="https://incommon.org">https://incommon.org</a>" /></div><div>        </PolicyRequirementRule></div><div>        ...</div><div><br></div><div>Where I think we expect something like the following in the entity's InC metadata:</div><div><br></div><div>  <Extensions><br>    <mdrpi:RegistrationInfo xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" registrationAuthority="<a href="https://incommon.org">https://incommon.org</a>"/><br>    <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"><br>      <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="<a href="http://macedir.org/entity-category">http://macedir.org/entity-category</a>" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>        <saml:AttributeValue><a href="http://id.incommon.org/category/registered-by-incommon">http://id.incommon.org/category/registered-by-incommon</a></saml:AttributeValue><br>      </saml:Attribute><br>    </mdattr:EntityAttributes><br>  </Extensions></div><div><br></div><div>However, we have now encountered an SP (entityID="<a href="https://login.offcampuspartners.com">https://login.offcampuspartners.com</a>") that is in the InC metadata, but for which these requirements are not present. I think this is the first time we've encountered issues with these conditions. But maybe we should be doing this differently now?</div><div><br></div><div>Any suggestions would be appreciated.<div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><font face="arial, sans-serif">Baron Fujimoto <<a href="mailto:baron@hawaii.edu" target="_blank">baron@hawaii.edu</a>> ::: UH Information Technology Services<br>minutas cantorum, minutas balorum, minutas carboratum descendus pantorum</font></div></div></div></div></div>