another attribute filtering thread

[Tom Zeller]

>>I modified the "Anatomy" sections on the Attribute Filtering Engine
>>Architecture[1] page, first because of grammar, then to simplify.
>
> I adjusted a bit (I think calling them Attribute Value Rules is misleading
> since they really operate on attributes, it's the match functors that
> evaluate values).

Oh, that is better.

> I noted it was actually describing these as containing a boolean for
> whether to permit/deny. That seemed less important than just sticking with
> the conceptual design, which is that there are explicit permit/deny rules.
>
>>Tomorrow I will likely chat with Rod about not porting the
>>MatchFunctor from v2 to v3. Both in code and schema it seems more of a
>>developer's shortcut than representing a domain object.
>
> Well, they're really just predicates.

Predicates in concept, but not in implementation, and that is my
complaint. If the MatchFunctor interface implemented two predicates
that would be better but I would still probably veto. And in the
schema, the MatchFunctor type extends IdentityType which just provides
an id attribute.

>>As an aside, I would like the wiki, code+javadoc, and schema to align
>>clearly, if possible.
>
> By wiki do you mean that design page, or the actual documentation?

By wiki I mean that design page. By actual documentation you mean

 https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter

?