configuring meta-attributes in the Shib IdP

[Cantor, Scott]

On 12/3/15, 4:06 PM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:


>
>So there's support for meta-attributes in metadata but not in queries? Hmm...

There is theoretical support in queries that could be added later but at the moment, it's a final filtering step that operates directly by exact match against the results of the resolution/encoding step. So no indirection at the moment.

The difference with queries is that you have normative behavior involved. You MUST filter, which means both sides have to agree on the semantics. And default semantics in SAML are exact only so without a profile documenting what *exactly* the meta-attribute can be satisified with, you can't actually do it.

RequestedAttribute is not a feature with normative requirements. The IdP isn't obligated to do anything with them, and if it wants to release X because Y is requested, it's allowed without any prior convention establishing that equivalence.

So aside from the code issues, one needs a spec and one doesn't, so I implemented the one that didn't.

-- Scott