AffiliationDescriptor

[Tom Scavo]

I searched the wiki for "AffiliationDescriptor" and to my surprise
discovered that IdP V3.4 will have limited support for the
<md:AffiliationDescriptor> role in metadata. That's very cool (and I
am continually blown away by the new feature set in V3.4).

So what happens when we combine an AffiliationDescriptor with a
metadata-driven configuration element? For example:

<!-- disable encryption for the designated RPs -->
<md:EntityDescriptor entityID="..." ...>
  <md:Extensions>
    <mdattr:EntityAttributes>
      <!-- disable encryption -->
      <saml:Attribute
Name="http://shibboleth.net/ns/profiles/encryptAssertions"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue xsi:type="xsd:boolean">false</saml:AttributeValue>
      </saml:Attribute>
    </mdattr:EntityAttributes>
  </md:Extensions>
  <md:AffiliationDescriptor affiliationOwnerID="...">
    <md:AffiliateMember>https://sso.example1.com/sp</md:AffiliateMember>
    <md:AffiliateMember>https://sso.example2.com/sp</md:AffiliateMember>
    <md:AffiliateMember>https://sso.example3.com/sp</md:AffiliateMember>
  </md:AffiliationDescriptor>
</md:EntityDescriptor>

Does this work as expected? What is the best way to load this entity descriptor?

Thanks,

Tom