EntityRoleWhiteList metadata filter

[Cantor, Scott]

On 6/26/18, 5:17 PM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:

> Do you agree? Are the above filters equivalent?

No, because you're wrong about what the role filter does.

Also your shorthand there to specify the role to test for in the script example is unlikely to be valid, that should probably just go after the SPSSODescriptors collection directly instead of trying to access it by QName via a script. A QName would be a real Java object you'd have to create, it's not just some XML expression in the script.

> I'm confused. The EntityRoleWhiteList filter above effectively removes
> all entities that do not contain an md:SPSSODescriptor role, right?
> Specifically, the filter removes entire entities, it does not remove
> individual roles. (If I'm wrong about that, I'm way off base.)

You're off base, it removes roles. Then the flag allows it to be told to remove the entity if it no longer has any roles afterward to get it out of the set since it has no function (but if it instead contained an affiliation, that would be broken, so don't do that if that's what you're dealing with).

-- Scott