Metadata support: EntitiesDescriptor/@Name handling

[Ian Young]

On 19 Aug 2013, at 14:36, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 8/19/13 9:28 AM, "Ian Young" <ian at iay.org.uk> wrote:
>> 
>> I wasn't proposing that for compatibility as such.  I don't think we
>> should regard it as a requirement to retain the current functionality of
>> the match functors for relying party match (which currently includes the
>> @Name hierarchy implicitly).
> 
> Agreed, but...
> 
>> Indeed, I think Chad and I both felt that we wanted to separate the
>> @Name thing out so that it wasn't being used by accident.
> 
> That would break compatibility. Are you suggesting we do that in this case?

Yes, actually.  I know it's rare that I say that, but I thought it was justified in this case as long as people who really require the previous effects have an alternative way to achieve them.

My recollection is that this (splitting @Name out of the relying party name match functor) was discussed some time back and we had decided to make that break.  I know Chad and I both felt it was appropriate.  If I'm labouring under a misapprehension or a mis-recollection then I guess we should continue the discussion.

> BTW, I wasn't actually talking about RelyingParty match behavior for the
> most part, I was thinking about the filtering.

Indeed that's not quite the same question.  In my mind, providing a way to extract entity attributes to augment the groupings derived from @Name hierarchy is just one way of providing a migration path; it's not the only one.  If it's hard to explain, I think just providing three match functors and letting people combine them in arbitrary ways would be fine too.

> I completely agree that if we work out how to plug in predicates into the
> RP lookup layer without screwing up compatibility, we should make all
> three notions explicit.

Does the Java code ever look up by @Name at this point?  I was assuming that the interesting place was the attribute release policies, or in general some post-lookup "does the entity I have in my hand have this @Name" kind of situation.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130819/bebcc3de/attachment-0001.bin