storing "data transparency" in consent records

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2018-06-01 18:47]:
> Typically what I would do is define beans based on the
> EntityAttributePredicate class in OpenSAML that know how to evaluate
> the tags, and then create different ones to check for the different
> conditions involved and inject them via the custom object hook we
> have for all the templates.

OK, so following
https://wiki.shibboleth.net/confluence/display/IDP30/VelocityVariables
and the example provided in
https://wiki.shibboleth.net/confluence/display/IDP30/Logging+Inside+Views
and using the bean defintion shared by Keith in
http://shibboleth.net/pipermail/users/2018-February/039201.html
... I added the following to conf/global.xml:

<util:map id="shibboleth.CustomViewContext">
    <entry key="RandS">
        <bean class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate">
            <constructor-arg>
                <list>
                    <bean class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"
                        c:name="http://macedir.org/entity-category"
                        p:values="http://refeds.org/category/research-and-scholarship" />
                </list>
            </constructor-arg>
        </bean>
    </entry>
    <entry key="CoCo">
        <bean class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate">
            <constructor-arg>
                <list>
                    <bean class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"
                        c:name="http://macedir.org/entity-category"
                        p:values="http://www.geant.net/uri/dataprotection-code-of-conduct/v1" />
                </list>
            </constructor-arg>
        </bean>
    </entry>
</util:map>

> Then you just have to do something like #if ($custom["RSCondition"].apply($rpmd))
> 
> I don't know offhand whether the RP metadata is right in the
> template or not, but it's accessible without much work.

I wasn't able to esily find anything on 'rpmd', so I added the code
from the example provided here to my template:
https://wiki.shibboleth.net/confluence/display/IDP30/VelocityVariables#VelocityVariables-LocatingtheOpenSAMLEntityDescriptorfortheRelyingParty

  #set ($outboundContext = $profileRequestContext.getOutboundMessageContext())
  #set ($samlPeerContext = $outboundContext.getSubcontext('org.opensaml.saml.common.messaging.context.SAMLPeerEntityContext'))
  #set ($metadataContext = $samlPeerContext.getSubcontext('org.opensaml.saml.common.messaging.context.SAMLMetadataContext'))
  #set ($spEntity = $metadataContext.getEntityDescriptor())

and then was able to check for RandS (or CoCo, respectively) using
your suggested example:

  #if ($custom["RandS"].apply($spEntity))
  #end

Amazingly that all worked, esp considering how little (if anything) I
understand about Spring and beans and all that.

I also think there could be easier ways to get there, I suggested one
idea here though that may not be the easiest yet:
https://issues.shibboleth.net/jira/projects/IDP/issues/IDP-1301

Thanks for the hand-holding,
-peter