Attribute filter

[Tom Zeller]

> On Jun 24, 2014, at 8:12 AM, "Rod Widdowson" <rdw at steadingsoftware.com> wrote:
> 
> I did some end to end testing for the AttributeInMetadata filter this
> morning.
> 
> I found a couple of important bugs and reminded myself yet again how much I
> detest that filter language.  But I did have a couple of questions, none of
> which are gating for Alpha ship so if people are busy elsewhere they should
> feel free to ignore this mail for a day or two.
> 
> I really wanted to test end to end which is to say to start with metadata,
> an authenticated user, an attribute-resolver.xml and an attribute-filter.xml
> and make sure that everything worked.
> 
> For the purposes of my testing I just edited the example attribute-filter
> and attribute-resolver which were in idp-conf, ran the test bed and
> eyeballed the logs and the result.  This was fine for what I was doing but
> I'd like to check in a more durable test.
> 
> I did think about adding some explicit flows to idp-config but that didn't
> seem to really fit since I wanted to test with the flows that we ship with.
> I suspect that it is the best bet, but I'm looking for suggestions for a
> good home for such tests (and thus how they should be structured).
> 
> 
> My other question is probably for Scott and goes back to our desire to use
> the AttributeInMetadata and EntityAttributeInMetadata functors as advanced
> replacements for the "AttributeRequestorEntityAttribute*" policy rules.
> 
> As deployed in V2 (and despite the class name), the AttributeInMetadata
> filter can only be used as a Value filter (it is the only filter with this
> restriction), which means that it inherits the attribute it is interested in
> from the enclosing <AttributeRule>.
> 
> In V3 the filter can be used in attribute rules and in policy rules, but its
> utility is pretty much restricted because it isn't tied to any attribute. So
> if you say
> 
> <PolicyRule xsi:type="saml:AttributeInMetadata" /> it will do the "if any
> attribute matches then this is true" behaviour.
> 
> I'd like to extend the syntax for this filter to allow an optional
> "attributeID", then we look towards say something like
> 
> <afp:PolicyRequirementRule xsi:type="saml:EntityAttributeInMetadata"
> attributeID="EntityCategory"/>
> 
> As an advanced replacement for
> 
> <afp:PolicyRequirementRule
> xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
> 
> attributeName="AttributeRequesterEntityAttributeExactMatch " />
> 
> thoughts?
> 
> /Rod
> 
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

(Mobile, excuse the formatting.)

For tests, I was thinking extend the AbstractFlowTests in idp-conf. Does that fit your needs or ? Is it the flows you want to modify or configs ?