AffiliationDescriptor

[Cantor, Scott]

> I had to come back and re-read this after letting it sit. I think I understand, and I
> was proposing replacing (hypothetical) EntityAttributes with
> AffiliationDescriptors. I was asking if there were any significant limitations on
> using AffiliationDescriptors this way if they get large. (Presuming SIRTFI is a
> target use case, I'm guessing not.)

Just the usual ones I guess, there might be some scaling issues in the code. I don't think it indexes any of this, it's pretty brute force. It wan't meant for large groups any more than anything handles that well. That's an EntityAttribute use case, certainly.

> So I think I'm talking about the "typical" use case, that this is what's supposed
> to be done, and that I wouldn't hit the race condition described in Tom's JIRA
> issue (https://issues.shibboleth.net/jira/browse/IDP-1294). Does this (example
> below) seem correct?

The feature is a replacement for EntitiesDescriptor groups moreso than EntityAttribute tagging, but if the set of SPs is smallish, it's fine as long as you don't intend to apply a rule in a metadata filter to do something based on the membership of that SP in an AffiliationDescriptor. That's the race...you can't process/filter/add to metadata using criteria based on another piece of metadata. I doubt that will ever be possible, but it would take a lot of work if it is, and probaby would look somewhat like what the SP software does in places, it actually supports sort of "nested" MetadataProviders that get processed and consumed by other components. It's a mess in most cases and nobody has ever done it.

Your attribute release example is the kind of case that works ok.

> I'm still confused around how (or if) the AffiliationDescriptor's groupID is bound
> to https://UCEntityID EntityDescriptor in the PolicyRequirementRule, but I
> think that is confusion around how AffiliationDescriptors in general and not
> anything specific to this thread or Tom's JIRA issue.

Yes, it's a bit odd. The entityID of the EntityDescriptor containing the AffiliationDescriptor is the name to which you attach policy based on the affiliation. It's a bit wacky, but it's because the top level object was EntityDescriptor and the schema didn't make AffiliationDescriptor an alternative top level thing with its own ID.

-- Scott