EntityRoleWhiteList metadata filter

[Tom Scavo]

On Tue, Jun 26, 2018 at 2:27 PM, Brent Putman <putmanb at georgetown.edu> wrote:
>
> It does completely ignore any AffiliationDescriptor if present.

Great, thanks. So I added an example to the wiki that claims the
following two filters are functionally equivalent:

<MetadataFilter xsi:type="EntityRoleWhiteList"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
    <RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

<MetadataFilter xsi:type="Predicate" direction="include"
removeEmptyEntitiesDescriptors="true">
    <ConditionScript xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
        <Script>
        <![CDATA[
            input.getAffiliationDescriptor() == null &&
input.getRoleDescriptors(md:SPSSODescriptor) != null;
        ]]>
        </Script>
    </ConditionScript>
</MetadataFilter>

Do you agree? Are the above filters equivalent?

>> What about the removeRolelessEntityDescriptors attribute? What is the
>> filter's working definition of "roleless entity descriptor?"
>
> "Roleless" means it doesn't contain any subtypes of the RoleDescriptor
> interface.  In schema terms it means it doesn't contain any elements which
> are effectively subtypes of md:RoleDescriptorType, which are essentially the
> ones in the first inner <choice> in the EntityDescriptor schema (which for
> the record also effectively includes extensions of RoleDescriptorType, like
> the concrete subtypes of QueryDescriptorType defined in the post 2.0
> extension)

I wondered about that. To that end, how would you encode the following
role descriptor in a <RetainedRole> element?

<md:RoleDescriptor xsi:type="query:AttributeQueryDescriptorType">

> In any case, why does this filter care about this?
>
> Do you mean why does it have an option to remove an EntityDescriptor which
> doesn't have one of the whitelisted roles?  Presumably if you only want to
> care about (and retain) certain whitelisted roles, then an EntityDescriptor
> that contains none of those is of no interest to you and is just taking up
> space, so might as well get rid of it.

I'm confused. The EntityRoleWhiteList filter above effectively removes
all entities that do not contain an md:SPSSODescriptor role, right?
Specifically, the filter removes entire entities, it does not remove
individual roles. (If I'm wrong about that, I'm way off base.)

> If you are filtering roles AND also actively using AffiliationDescriptors,
> then the above conditional about only caring about whitelisted roles isn't
> true, so you'd want to set 'removeRolelessEntityDescriptors' to false to
> retain EntityDescriptors which don't have a whitelisted role but do have an
> AffiliationDescriptor.

An entity can't have both, so again I'm confused. I don't see any
purpose for removeRolelessEntityDescriptors.

Sorry for poking the bear but I really do want to get to the bottom of this.

Thanks,

Tom