Page Comparison

...

A common use case is enabling SAML 1 for legacy systems, often combined with either enabling queries or attribute push (to eliminate the queries). This is not handled as well via this mechanism because one generally enables most profiles by default, and it's not practical to enable them and then try and disable them for all but a few SPs. The This goal is the opposite, disable by default and enable the profiles for a few exceptions.

...

The AttributeFilterConfiguration has had support for metadata-driven configuration for a while now, but it hasn't been extensively used. A logical approach may be is to align usage with the property-driven model outlined above and move to a per-attribute policy model, in contrast to the fairly common model today of defining policies around services. Since the filter layer operates by iterating over all policies to determine if they apply, it may be more efficient for larger policy sets to redesign policies around tags that signal release of each individual attribute.

To facilitate the sharing of examples, building of tools, and a more useful set of default rules in the software, we have agreed to reserve the following SAML Attribute for use in constructing filter policies:

Name: http://shibboleth.TBDnet/ns/attributes/releaseAllValues

NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:uri

Values: Each value is an internal Attribute ID whose values should be released to an SP whose metadata contains the relevant tag/value.

Example

Here's an example policy (more or less matching an example in the default file) that applies this tag test:

    <AttributeFilterPolicy id="Per-Attribute-singleValued">
        <PolicyRequirementRule xsi:type="OR">
            <Rule xsi:type="NOT">
                <Rule xsi:type="Value" attributeID="FERPA" value="Y" />
            </Rule>
            <Rule xsi:type="Value" attributeID="eduPersonScopedAffiliation" value="employee" />
            <Rule xsi:type="EntityAttributeExactMatch" attributeName="http://macedir.org/entity-category"
                attributeValue="urn:mace:osu.edu:shibboleth:attribute-def:FERPA" />
        </PolicyRequirementRule>

        <AttributeRule attributeID="eduPersonPrincipalName">
            <PermitValueRule xsi:type="EntityAttributeExactMatch" attributeName="urn:mace:osu.edu:shibboleth:attribute-release"
                attributeValue="eduPersonPrincipalName" />
        </AttributeRule>
	

Reference