EntityRoleWhiteList metadata filter

[Brent Putman]

On 6/26/18 5:17 PM, Tom Scavo wrote:
>
> Do you agree? Are the above filters equivalent?

No, per what Scott said.

>
> I wondered about that. To that end, how would you encode the following
> role descriptor in a <RetainedRole> element?
>
> <md:RoleDescriptor xsi:type="query:AttributeQueryDescriptorType">

You would just use the QName of the xsi:type rather than the QName of
the element. So:

<RetainedRole>query:AttributeQueryDescriptorType</RetainedRole>


> I'm confused. The EntityRoleWhiteList filter above effectively removes
> all entities that do not contain an md:SPSSODescriptor role, right?
> Specifically, the filter removes entire entities, it does not remove
> individual roles. (If I'm wrong about that, I'm way off base.)

As Scott said, you're off base, it removes RoleDescriptors.

In case it's not obvious: The whole point of this filter is to remove
roles that are not relevant to the consuming entity.  For example, if
you're an SP or discovery service, you likely only care about
IDPSSODescriptors (if SP, maybe also AttributeAuthorityDescriptors). 
So you'd be interested in removing all SPSSODescriptor and other
roles.  If the removal of roles from an entity results in an entity
with no roles, there's generally no point in keeping the entity
around.  Unless you need to support consuming AffiliationDescriptors,
in which case you should set the flag to not remove roleless
EntityDescriptors.  As you pointed out, all entities with
AffiliationDescriptors are by definition roleless.


>
>> If you are filtering roles AND also actively using AffiliationDescriptors,
>> then the above conditional about only caring about whitelisted roles isn't
>> true, so you'd want to set 'removeRolelessEntityDescriptors' to false to
>> retain EntityDescriptors which don't have a whitelisted role but do have an
>> AffiliationDescriptor.
> An entity can't have both, so again I'm confused.

You're right, I spoke too quickly.  A single entity can't have both
role(s) and AffiliationDescriptor.  But you certainly can have a
multitude of entities with one case or the other being processed by the
same filter.


>  I don't see any
> purpose for removeRolelessEntityDescriptors.
>

Hopefully the clarification that the fundamental functionality of the
filter is to remove role descriptors makes the purpose more clear.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180626/8ea37a22/attachment.html>