AffiliationDescriptor

[Eric Goodman]

>> Is it reasonable to use this feature as a direct entity attribute replacement? I.e.,
>> publish one AffiliationDescriptor per existing EntityAttribute? Any scaling
>> issues with having too many AffiliationDescriptors, or with descriptors having
>> too many members?

>It doesn't work *with* them right now, that was my point, it works instead of them. 
>It's a replacement for the old practice of embedding things inside EntitiesDescriptor 
>groups and then using the group name in the config (explicitly in V3, it has "by group" 
>notions in the syntax for expressing that).

I had to come back and re-read this after letting it sit. I think I understand, and I was proposing replacing (hypothetical) EntityAttributes with AffiliationDescriptors. I was asking if there were any significant limitations on using AffiliationDescriptors this way if they get large. (Presuming SIRTFI is a target use case, I'm guessing not.)


So I think I'm talking about the "typical" use case, that this is what's supposed to be done, and that I wouldn't hit the race condition described in Tom's JIRA issue (https://issues.shibboleth.net/jira/browse/IDP-1294). Does this (example below) seem correct?


I'm imagining UCOP (or some UC entity) publishes an AffiliationDescriptor like this in its metadata (in InCommon or a separate aggregate), saying that it's okay to release an employee ID to a list of SPs:

<md:EntityDescriptor entityID="https://UCEntityID">
   ....
  <md:AffiliationDescriptor affiliationOwnerID="https://uctrustrelease.ucop.edu/HypotheticalUCEmployeeID">
    <md:AffiliateMember>https://sso.example1.com/sp</md:AffiliateMember>
    <md:AffiliateMember>https://sso.example2.com/sp</md:AffiliateMember>
    <md:AffiliateMember>https://sso.example3.com/sp</md:AffiliateMember>
  </md:AffiliationDescriptor>
</md:EntityDescriptor>


And the various UC IdPs would do something like this in their configurations:

<AttributeFilterPolicy id="ReleaseEmployeeIDforUCTrustAuthorizedSPs">
   <PolicyRequirementRule  xsi:type="InEntityGroup" groupID=" https://uctrustrelease.ucop.edu/HypotheticalUCEmployeeID"/>
 
  <AttributeRule attributeID="HypotheticalUCEmployeeID">  
    <PermitValueRule xsi:type="basic:ANY"/>
  </AttributeRule>
</AttributeFilterPolicy>


(My IdP configuration experience is 6 years out of date, so apologies for any glaring errors)



I'm still confused around how (or if) the AffiliationDescriptor's groupID is bound to https://UCEntityID EntityDescriptor in the PolicyRequirementRule, but I think that is confusion around how AffiliationDescriptors in general and not anything specific to this thread or Tom's JIRA issue.

--- Eric