Shibboleth Developers

[Ian Young <>]

Alistair Young wrote:

> that's what I thought. Is there any reason it wouldn't release an
> attribute even if the attribute appeared as:
> 
> <Rule>
>   <Target>
>     <AnyTarget></AnyTarget>
>   </Target>
>   <Attribute name="urn:mace:dir:attribute-def:eduPersonTargetedID">
>     <AnyValue release="permit"></AnyValue>
>   </Attribute>
> </Rule>
> 
> Alistair

A Shibboleth IdP won't (can't) release ePTI to an SP that hasn't been
authenticated, for example because it hasn't provided a credential on
the attribute callback.

I say this specifically because I'm aware you may have been brought in
to help debug a problem of exactly this type...

        -- Ian