[JIRA] (IDP-1877) Allow for global Metadata-Filter

[Clemens Bergmann (Jira)]

Clemens Bergmann ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=617bb50a5800630069a5b0f0 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiZjhjODI1NDNkMzU0NGE0YmEzYjQxYzkyNTI5YTYyNTIiLCJwIjoiaiJ9 ) / New Feature ( https://shibboleth.atlassian.net/browse/IDP-1877?atlOrigin=eyJpIjoiZjhjODI1NDNkMzU0NGE0YmEzYjQxYzkyNTI5YTYyNTIiLCJwIjoiaiJ9 ) IDP-1877 ( https://shibboleth.atlassian.net/browse/IDP-1877?atlOrigin=eyJpIjoiZjhjODI1NDNkMzU0NGE0YmEzYjQxYzkyNTI5YTYyNTIiLCJwIjoiaiJ9 ) Allow for global Metadata-Filter ( https://shibboleth.atlassian.net/browse/IDP-1877?atlOrigin=eyJpIjoiZjhjODI1NDNkMzU0NGE0YmEzYjQxYzkyNTI5YTYyNTIiLCJwIjoiaiJ9 )

Issue Type: New Feature Affects Versions: 4.1.4 Assignee: Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) Components: Metadata Created: 03/Nov/21 3:02 AM Priority: Trivial Reporter: Clemens Bergmann ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=617bb50a5800630069a5b0f0 )

hi,

we currently have a IdP 4.1 running which has multiple (currently 19) MetadataProviders of different Types configured.
The metadata-provider.xml is configured by puppet.
Now we start to depend some parts of our coniguration on entityAttributes. We want to inject these attributes via filters that are also configured by puppet.
Curently puppet generates a dedicated metadata-filters.xml file which contains a MetadataFilter of type ByReference. To match the Filters to the correct MetadataProvider we have to specifiy the providerRef manually in the puppet configuration. This is no problem for me but one goal of the puppet configuration is that people who are not as familiar with our shibboleth configuration can also make this adjustment.
My goal is to remove the need to find and specify the providerRef.
I see three possible implementation to reach this goal.

One would be an option to add MetadataFilter to ChainingMetadataProvider. I could then put all Filters on the toplevel ChainingMetadataProvider. This would fit our needs but if there are multiple top-level MetadataProviders this would not allow global filtering.

The second option is to add the option to specify a global MetadataFilter. It could be a ByReference MetadataFilter with an ID that is referenced in a property and added to every MetadataProvider implicitly.

The third option is to allow multiple providerRef to be specified in MetadataFilter of type ByReference. I would then simply add all IDs with puppet. This is not as elegant as the global filter but could be a quick win. If I see it correctly it could be implemented in ByReferenceMetadataFilter ( https://git.shibboleth.net/view/?p=java-opensaml.git;a=blob;f=opensaml-saml-impl/src/main/java/org/opensaml/saml/metadata/resolver/filter/impl/ByReferenceMetadataFilter.java#l72 ) or ByReferenceParser ( https://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-profile-spring/src/main/java/net/shibboleth/idp/profile/spring/relyingparty/metadata/filter/impl/ByReferenceParser.java#l71 )

If you have any questions about this don't hesitate to reach out.

Kind regards
Clemens

( https://shibboleth.atlassian.net/browse/IDP-1877#add-comment?atlOrigin=eyJpIjoiZjhjODI1NDNkMzU0NGE0YmEzYjQxYzkyNTI5YTYyNTIiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1877#add-comment?atlOrigin=eyJpIjoiZjhjODI1NDNkMzU0NGE0YmEzYjQxYzkyNTI5YTYyNTIiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:8e458bc )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211103/157b4337/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-7ef60931-113d-4d74-9c2c-d6998eb60d40
Type: image/png
Size: 341 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211103/157b4337/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-64e1e032-318d-430e-96fb-c7268c6442f5
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211103/157b4337/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-e5ffa77d-5a0a-457e-9204-46a1cb267678
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211103/157b4337/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-e35d3a27-873e-4913-b323-d5a614b1c762
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211103/157b4337/attachment-0007.png>