EntityRoleWhiteList metadata filter

[Brent Putman]

On 6/26/18 12:25 PM, Tom Scavo wrote:
> But there are two completely different types of entity descriptor (as
> you know). Either the entity contains one or more role descriptors or
> the entity contains a single affiliation descriptor.

Yes.  AffiliationDescriptor is not a (subtype of) RoleDescriptor, and
that's how the nested <choice> elements in the EntityDescriptor define
things.

>  So the question
> is: Should this filter completely ignore the latter?

It does completely ignore any AffiliationDescriptor if present. IIRC I
didn't write it - I think Chad did.  But IMHO that's correct given its
purpose.  It's the EntityRoleFilter (in OpenSAML) and the
EntityRoleWhiteList in the IdP schema.  It's right there in the names. 
It's about roles.  AffiliationDescriptor is not a role.

>
> To summarize: This filter excludes ALL entities that contain an
> affiliation descriptor (which is the opposite of what it should do).

No, it does not fundamentally do anything with respect to
presence/absence of an AffiliationDescriptor, period.  It doesn't even
look at it.

And technically the filter doesn't fundamentally "exclude" entities. 
Its purpose is to remove from entities (subtypes of) RoleDescriptors
which aren't in the supplied whitelist.

>
> What about the removeRolelessEntityDescriptors attribute? What is the
> filter's working definition of "roleless entity descriptor?"

"Roleless" means it doesn't contain any subtypes of the RoleDescriptor
interface.  In schema terms it means it doesn't contain any elements
which are effectively subtypes of md:RoleDescriptorType, which are
essentially the ones in the first inner <choice> in the
EntityDescriptor schema (which for the record also effectively includes
extensions of RoleDescriptorType, like the concrete subtypes of
QueryDescriptorType defined in the post 2.0 extension):

           <choice>
 *               <choice maxOccurs="unbounded">**
**                    <element ref="md:RoleDescriptor"/>**
**                    <element ref="md:IDPSSODescriptor"/>**
**                    <element ref="md:SPSSODescriptor"/>**
**                    <element ref="md:AuthnAuthorityDescriptor"/>**
**                    <element ref="md:AttributeAuthorityDescriptor"/>**
**                    <element ref="md:PDPDescriptor"/>**
**                </choice>*
                <element ref="md:AffiliationDescriptor"/>
            </choice>


> In any
> case, why does this filter care about this?
>

Do you mean why does it have an option to remove an EntityDescriptor
which doesn't have one of the whitelisted roles?  Presumably if you
only want to care about (and retain) certain whitelisted roles, then an
EntityDescriptor that contains none of those is of no interest to you
and is just taking up space, so might as well get rid of it.

If you are filtering roles AND also actively using
AffiliationDescriptors, then the above conditional about only caring
about whitelisted roles isn't true, so you'd want to set
'removeRolelessEntityDescriptors' to false to retain EntityDescriptors
which don't have a whitelisted role but do have an AffiliationDescriptor.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180626/f8583cc9/attachment.html>