configuring meta-attributes in the Shib IdP

[Cantor, Scott]

On 12/3/15, 10:15 AM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:


>
>How do I configure a meta-attribute in the Shib IdP software?
>Specifically, I want to configure a policy rule something like this:

That isn't what that concept is referring to. You can't release a so-called meta-attribute. A meta-attribute is a concept whereby the SAML RequestedAttribute name being checked in the policy is indirectly connected to the attribute(s) you actually release when it's present.

In other words, if you see RequestedAttribute Name="Foo", release IdPAttribute "bar" (or "bar" and "bar2", etc.)

The policy requirement matcher involved is [1]. The "meta" part was addressed by adding the attributeName option. The way the matcher used to be used is in the example at the bottom:

<PermitValueRule xsi:type="AttributeInMetadata" onlyIfRequired="true" matchIfMetadataSilent="true"/>

That would show up inside an AttributeRule for a specific attribute, and the idea was that it would automatically figure out at runtime what the SAML attribute name would have to be. It was all sort of implicit. It works when you don't need the indirection.

But if you use it in a PolicyRequirementRule and specify the attributeName, it becomes indirect. Now it's saying "if the RequestedAttribute set includes X, run this policy". And then the policy contains ordinary AttributeRules that release any value, for all the attributes you want it to treat as a "match".

Originally, you couldn't specify attributeName, and so only the implicit exact matching behavior was supported, and it really could only be used inside an AttributeRule. The discussion with Leif caused the light bulb to go on for me and I realized we could add that setting, start using the same function in the PolicyRequirementRule slot, and automatically support the use case.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/AttributeInMetadataConfiguration