Reverse attribute mapping..

[Rod Widdowson]

As a reminder of the backstory: we want to be able to map from
<RequestedAtribute> statements in metadata to an native IdP attributes.
This was the AttributeInMetadata filter just has to compare native IdP
attributes and native IdP values.  A lot of the history is contained in the
comments for IDP-264.

The design of the reverse mapper was done with an eye to the
"urn:mace:shibboleth:2.0:attribute-map"  schema which the SP implements, but
following our current plan of not introducing any more custom parsers in V3
we decided to initially configure this via Spring only.

I have just worked through a small example based on the some of the
attribute definitions in the V2 attribute-resolver.xml, with a couple of
changes to try to explore some of the oddness that the config has to deal
with - in particular the ability to go encode one IdP attribute as two SAML
attributes and for the same SAML attribute to be encoded by two IdP
attributes.

I checked this in to svn under
idp-attribute-filter-spring:src/test/resources/net/shibboleth/attribute/mapp
er/attributesmapper.xml

My observations in doing this:

1)  It is totally mind bending trying to keep the problem statement and the
configurations and what you are trying to do in your head.  I found that the
easiest thing was to do a quick revision of the issue in the round ("Making
AttributeInMetadata filters work") and after that concentrate on just one
thing: "how to make a revere mapping for this attribute-resolver segment".
We will need to provide reasonable examples for people to work from if we
make this main stream.

2) The current implementation uses the identification of the
SAMLAttributeMapper to provide the identity of the IdP attribute.  I find
that this is incredibly inelegant in the Spring configuration and unless
someone says so I'm going to change that such that the id is just an id (so
for instance one could use the SAML friendlyName) and put all the attribute
IDs into the alias.

3) Otherwise it hangs together reasonably sensibly.

4) I am still intending spending some time to see whether it is possible to
create a system to map from the attribute filtering engine to this
configuration.  Whilst it would not do for the specialized case it might be
enough to keep the 95% case under control and not have to worry too many
people about the "100 different meanings for the word attribute" problem
which besets this area.

If people with an interest in this area could look that example file and
check for correctness as well as make any other comments, I'd be very
grateful.

Thanks

/Rod