Niels van Dijk writes:
Why not disable scope checking on the sp side?
I thought I did that, but after reading through the Shibboleth wiki last
night, I think my attribute extractor config in Shibboleth is wrong.
I'm going to remove the AttributeDecoder statements entirely and see
what that gets me.
Or rescope everything to what you have your proxy
issue?
The proxy isn't issuing anything for COmanage - it passes the IdP's
assertions unchanged for registration purposes. I will properly scope
the VO identifier for my other SPs, because that lets me use the default
Shibboleth configuration.
Thanks!
Matthew
--
"The lyf so short, the craft so longe to lerne."