Issue with attribute release using entitycategories and core:AttributeLimit

[Євгеній Преображенський]

Hi SimpleSAMLphp community,

I am seeking help regarding the behavior of the entitycategories and core:AttributeLimit modules. Currently, attributes are being released to all SPs, even those without a defined Entity Category, despite my configuration.

  My saml20-idp-hosted.php configuration is as follows:  
            30 => [ 'class' => 'core:AttributeAdd', 'eduPersonAssurance' => ['https://refeds.org/assurance/IAP/medium', 'https://refeds.org/assurance', 'https://refeds.org/assurance/profile/cappuccino', 'https://refeds.org/assurance/IAP/local-enterprise'] ],
            40 => [ 'class' => 'core:AttributeAdd', 'schacHomeOrganization' => ['bitp.kiev.ua'] ],

            60  => [
                    'class' => 'entitycategories:EntityCategory',
                    'default' => true,
                    'strict' => true,
                    'allowRequestedAttributes' => true,
                    'http://refeds.org/category/research-and-scholarship' => [
                        'displayName',
                        'sn',
                        'givenName',
                        'mail',
                        'eduPersonPrincipalName',
                        'eduPersonScopedAffiliation',
                    ],
                    'https://refeds.org/category/personalized' => [
                        'eduPersonAssurance',
                        'schacHomeOrganization',
                        'subject-id',
                        'displayName',
                        'givenName',
                        'sn',
                        'mail',
                        'eduPersonScopedAffiliation',
                    ],
            ],

            80 => [ 'class' => 'core:AttributeLimit', 'default' => true, ],
            90 => [ 'class' => 'core:AttributeMap', 'name2oid'],

The Problem:
It seems that when an SP does not have an Entity Category set, the IdP still releases all available attributes instead of restricting them. We are trying to pass the eduGAIN release check (https://noec.release-check.edugain.org/), but we cannot successfully enforce the attribute release rules.

Could you please advise if I am missing any configuration steps or if there is a known issue with this interaction?

Thank you in advance!
Yevhenii Preobrazhenskyi, URAN Association