EntityRoleWhiteList metadata filter

[Tom Scavo]

On Wed, Jun 27, 2018 at 6:11 PM, Brent Putman <putmanb at georgetown.edu> wrote:
>
>> Unfortunately the getSPSSODescriptor method takes a protocol
>> string argument, so that looks like a dead end, at least for my
>> purposes.
>
> Well, it's less convenient for your purposes than a no-arg one, but if all
> you practically care about is SAML 2 (and maybe SAML 1) then you can
> certainly call that method with the relevant protocol URI string(s) and
> achieve what you want.

Sure, but that's a hack I'd rather avoid.

>> There is a no-argument getRoleDescriptors() method but I don't know
>> how to map the resulting list of RoleDescriptor objects to the
>> corresponding list of local names. If I knew how to do that, I could
>> test if the list of local names contains "SPSSODescriptor".
>
> What you want to look at is the XMLObject interface.  You can get the role
> descriptor elements' QNames via getElementQName().  And if necessary also
> the xsi:type QName via getSchemaType().  Then eval the QNames however you
> want, either by testing for equality against either a QName constant or one
> you have constructed (probably the most correct) or just looking at the
> getLocalPart() of the QName.

Thanks for the useful tips.

> If using Java 8 at runtime, the most natural way to literally map the
> descriptor list to a new list of type QName and then evaluate it would be
> using lambdas.  Then that whole test becomes a one-liner.
>
> Most compact, using method ref and default helper method:
>
>         boolean found = entity.getRoleDescriptors().stream()
>                 .map(RoleDescriptor::getElementQName)
>
> .anyMatch(Predicate.isEqual(SPSSODescriptor.DEFAULT_ELEMENT_NAME));
>
> Less compact, using full Function and Predicate lambda expressions:
>
>         boolean found = entity.getRoleDescriptors().stream()
>                 .map(role -> {return role.getElementQName();})
>                 .anyMatch(name -> {return
> SPSSODescriptor.DEFAULT_ELEMENT_NAME.equals(name);});

Wonderful! I can definitely work with that.

> I don't know what syntax modifications
> are necessary to work in JSR-223 scripting using Javascript, etc.  In fact I
> don't know for sure whether and how lambdas work in scripts at all, maybe
> someone else does.

I can guess :-) JavaScript has no notion of a static member so I'll
refactor your latter example to use the local part of each QName:

input.getRoleDescriptors().stream()
        .map(function(role) role.getElementQName().getLocalPart())
        .anyMatch(function(name) name.equals("SPSSODescriptor"));

I haven't tested that but I'll bet it's close.

Thanks Brent!

Tom