AttributeInMetadata

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2012-11-20 20:17]:
> >Can we get AttributeInMetadata filter rules (as implemented in
> >uApprove and perfectly usable in the Shib IdP) included in the IdP,
> >e.g. with 2.4?
> 
> The problem is that I'd have to change the plugin type to avoid
> conflicting with it. I'm not unwilling, but my suspicion was that would
> create more confusion than help, since using the extension with any
> version amounts to dropping one jar in lib and re-running install.

Plus adding the SWITCH-namespaced xml ns declarations to the attribute
filter, yes. Maybe not directly comparable, but protecting the ECP
endpoint with httpd was trivial as well. (Not so trivial with any
servlet container, granted.)

Unless there are technical (or legal or whatever) barries preventing
this I'd really like to see the IdP do that without additional steps
involved by the deployer. So maybe something can be worked out (would
including it as-is work, even if someone followed the stepts to add it
themselfs?).
I (possibly naively) think this is the best shot we currently have at
automating attribute release on a global level and by that solving a
large part of the (inter-)feeration scalibilty problem, where (lack
of) attributes is a main concern. At least if used in conjunction with
other things, like registration procedures by Federation Operators and
someting like the "Data protection Code of Conduct", the InCommon R&S
(or other) entity categories and attribute bundles, etc.
-peter