GeezerVison

We hit this in production with pyFF 2.1.5 (the docker.sunet.se/pyff:2.1.5-stable image), and it also affects /api/search, not only the discojson pipe.

Real-world impact: NHS England publishes one OpenAthens IdP (https://idp.eng.nhs.uk/openathens) for 364 organisations. Its IDPSSODescriptor/Extensions holds 364 oaf:ScopedUIInfo elements, followed by the IdP's own mdui:UIInfo ("NHS in England"). /api/search returned the first scoped name, "University Hospitals of Leicester NHS Trust (UHL)", as the title for every NHS England user. Users searching for their own trust thought it was missing, and a customer reported it to us.

Across the UK federation, OpenAthens, InFed, DFN and eduGAIN feeds we load, 180 IdPs carry ScopedUIInfo, and 126 of them got a sub-organisation's name as their title (e.g. NHS Scotland, NHS Wales, several US hospital systems and Japanese universities).

Our workaround, in case it helps others: an xslt step in the per-feed pipeline that moves mdui:UIInfo before the ScopedUIInfo elements, so the first DisplayName in document order is the IdP's own:

<xsl:template match="md:IDPSSODescriptor/md:Extensions[oa:ScopedUIInfo and mdui:UIInfo]">
  <xsl:copy>
    <xsl:apply-templates select="@*"/>
    <xsl:apply-templates select="mdui:UIInfo"/>
    <xsl:apply-templates select="node()[not(self::mdui:UIInfo)]"/>
  </xsl:copy>
</xsl:template>