== [[https://iam.alaska.edu/shib|Shibboleth]] / Setup Attribute Release from IdP to an SP ==

This page documents how to setup an IdP to release attributes to an SP via its entityID.

1. Check out the conf directory from the shib-svn repository.
{{{
john@fearless:~/Junk$ svn co svn+ssh://sxjpm@iron.alaska.edu/usr/local/iam/shib-svn/idp/trunk/conf
A    conf/service.xml
...
A    conf/login.config
}}}

2. Add a stanza in the attribute-filter.xml config file that releases an attribute to the SP via its entityID.
{{{
john@fearless:~/Junk$ vi conf/attribute-filter.xml
...
<AttributeFilterPolicy id="releaseToIAM">
    <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://idmt-1.alaska.edu/shibboleth" />
    <AttributeRule attributeID="eduPersonPrincipalName">
        <PermitValueRule xsi:type="basic:ANY" />
    </AttributeRule>
</AttributeFilterPolicy>
...
:wq!
}}}

3. Commit the the changed attribute-filter.xml file into the shib-svn repository.
{{{
john@fearless:~/Junk$ svn commit conf/ -m "Added attribute filter config for SP idmt-1"
}}}

4. Test and update the Shibboleth !IdPs with the [[https://iam.alaska.edu/shib/wiki/TestIdPConfig|Test IdP Config Change]] procedure.

References:[[br]]
* [[https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter|Shibboleth Attribute Filter Documentation]]
* filter to release TransientID to all EXCEPT named SPs by "Qian, Yi" <yqian@ku.edu>:
{{{
<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone">

		<afp:PolicyRequirementRule xsi:type="basic:NOT">
			<basic:Rule xsi:type="basic:OR">
				<basic:Rule xsi:type="basic:AttributeRequesterString"
					value="sandbox 1 sp entity id" />
				<basic:Rule xsi:type="basic:AttributeRequesterString"
					value="sandbox 2 sp entity id" />
			</basic:Rule>
		</afp:PolicyRequirementRule>

		<afp:AttributeRule attributeID="TransientId">
			<afp:PermitValueRule xsi:type="basic:ANY" />
		</afp:AttributeRule>

	</afp:AttributeFilterPolicy>
}}}