Hi @smangelsdorf , I'm only doing here exactly what MetadataGenerationService already has here to determine whether Scope is regexp:

https://github.com/ausaccessfed/federationregistry/blob/master/app/plugins/metadata/grails-app/services/aaf/fr/metadata/MetadataGenerationService.groovy#L341

I first thought we'd have to implement this via a boolean flag on the attribute value marking it regexp, but I then just followed what's already done for Scope.

Longterm, we should be actually approving eduPersonEntitlement via an approval workflow.

Dodgy things entered here could make an IdP release more than is desired - but that can be done also with just a ````^.*$````

Attribute values won't really be multiline, so multiline matching doesn't have to be considered here.

I see the relevant commits for where this came in for Scope are 6afc6a736361c795d1bd46c1bad126badb35e43e and 76c41461333334e13ac15125a84086f1d0b6a0f3

@bradleybeddoes , your thoughts on this?

Cheers,
Vlad