Attribute filter

[Rod Widdowson]

> I need to get straight what's in 2.4 and what's new here and make sure the
> names make sense.

In case it helps and to save you time V2 has 4 EntityAttribute match
functors:

AttributeIssuerEntityAttributeExactMatch 
AttributeRequesterEntityAttributeExactMatch
(https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirementAt
tributeRequesterEntityAttributeExactMatch)
AttributeIssuerEntityAttributeRegexMatch
AttributeRequesterEntityAttributeRegexMatch

These take as input the *SAML Attribute Name* and the *SAML Attribute Value*
for instance:

<afp:PolicyRequirementRule
    xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
    attributeName="http://macedir.org/entity-category"
 
attributeValue="http://id.incommon.org/category/research-and-scholarship" />

SAML NameFormat is ignored. Only string are compared.

The AttributeRequested variants are ported straight across in V3 and work
unchanged (by looking directly at the SAML metadata and SAML Attributes
inside the filter)

Also in 2.4 is 

AttributeInMetadata.
(https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirementAt
tributeInMetadata)

This works on Requested Attributes from the ACS.  What is specified
(indirectly) is the *IdP Attribute Name*.

<AttributeRule attributeID="eduPersonPrincipalName">
  <PermitValueRule xsi:type="saml:AttributeInMetadata"
onlyIfRequired="false"/>
</AttributeRule>

In V2 the filter does the reverse mapping of the SAML attribute[s] to the
IdPAttribute[s] inline
In V2 this is restricted to only be a PermitValueRule or a DenyValueRule.  

This has been ported to V3 but works on IdP Native
Attributes/RequestedAttributes.  SAML [Requested]Attributes are converted
when the metadata loads by reference to the current attribute resolver
configuration.   

The net result is the same as V2.4 except
1) This can also be in a PolicyRule (but only with a wildcard attributeID)
2) This should have significantly better behaviour for non string attribute
values (scoped, XMLObject)

In V3 I have added a type saml:EntityAttributeInMetadata which is configured
and behaves just as saml:AttributeInMetadata *EXCEPT* that the mapped
attributes come from the EntityAttributes on the entity, not from the
RequestedAttributes on the ACS.  This, we believe, can be an advanced
configuration alternative to the AttributeRequesterEntityAttribute* functors
I mention at the top. The utility will be limited to the non-string
attribute values or NameFormat distinction.  However to be generally useful
in the PolicyRule slot, we need to be able to specify an explicit
attributeID