[java-identity-provider COMMIT] /trunk/idp-saml-impl/src/main/java/net/shibboleth/idp/saml/profile/logic/EntitiesDesc...

[Brent Putman]

On 5/30/14 8:46 PM, Cantor, Scott wrote:
> I remember discussing something else, I didn't go looking for it. I was
> more concerned about configuring this than implementing it, I just needed
> something to test with.
>
> The filter implementation was done a while ago, I was just adding some
> error checking.


That's fine, I just wanted to make sure we weren't forgetting about
this, in general.  In the past Chad, and to a certain extent Ian, were
saying EntitiesDescriptors == Bad.

>
>
> I don't think either Rod nor myself are familiar with that code so it's
> not currently part of the configuration logic. We would presumably have to
> bake this into the default metadata configuration parsing code, because if
> the group policy implementations relied on it, they'd have to be installed
> without the user actually putting them in, since they're not in the V2
> configuration now.

Oh right, for the legacy config.  Yeah, it's very easy, just a single
filter with these 1 or 2 node processor plugins.  For the Spring native
config, it's really just a bit of additional wiring, nothing complicated
about it.


>
>> Walking the tree for the EntitiesDescriptors as below does currently
>> work, because the metadata resolvers don't currently destroy or mutate
>> the tree structure.  But with our new EntityDescriptor-centric focus,
>> that's not guaranteed to always be the case - unless we decide that
>> preserving it is a requirement, but that would be moving in the opposite
>> direction from what I thought we wanted.
> Preserving the functionality is a requirement, but if we're going to do it
> a different way, we probably need an issue to track that.

I don't have any plans to destroy the tree, I'll probably just leave it
the way it is, presumably doesn't hurt anything. I just thought it best
to reserve the right to change it, if we want. 

The idea was that the only thing that should ever look at
EntitiesDescriptors was the metadata resolver(s) themselves.  Once the
metadata is processed, callers don't know or care about them anymore.


>
> Is the code for these new filters complete?

Yes, as far as I know.  Barring any undiscovered bugs, etc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20140530/bfbea5f7/attachment.html