Filtering and identifiers and logging.

[Ian Young]

On 20 Jun 2013, at 21:40, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 6/20/13 2:05 PM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:
> 
>> I suppose the follow on question is whether we think anyone is actually
>> using the references?  I've been struggling to get it working and it seems
>> to (although I have yet to work out why!) but in the V2 implementation the
>> reference has to be in the text content:
>> 
>> <AttributeRuleReference>Reference</AttributeRuleReference>
>> 
>> Rather than what the schema seems to infer
>> 
>> <AttributeRuleReference ref="Reference"/>
> 
> The schema disallows that syntax, and I checked a V2 IdP and it rejected
> it [1]. I tested with PolicyRequirementRuleReference, but the schema's the
> same.

I think the schema is broken, whichever way you look at it.  The intention is clearly to have a "ref" attribute holding the reference, but there's not "use" specified so the "ref" ends up optional.  And yes, the code looks as if it reads the text content rather than the ref attribute but the schema doesn't say anything about the element content.  I guess it's another of those cases where you end up with an open content model by accident.

> Anybody using references out there? I thought I had, but I don't see any,
> so now I'm wondering.

I don't think I knew about references until prepping for this review, and I still can't find it in the documentation at https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter

Of course, as soon as I learned about it I thought "way cool" and wanted to configure my ARP using it heavily.  I guess I should, um, not bother with that.

	-- Ian



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20130621/63a0263b/attachment.bin