AffiliationDescriptor

[Tom Scavo]

On Wed, May 23, 2018 at 10:16 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>> So what happens when we combine an AffiliationDescriptor with a metadata-
>> driven configuration element?
>
> I don't think it works...
>
> What would be nice is to be able to attach a tag with a filter based on a condition/predicate that depended on affiliation, which accomplishes the same end result with less or no code changes

Yes, that works for me :-) A one-time configuration on a metadata
provider can associate a configuration entity attribute to an entity
that contains an affiliation role. The actual entity list can be
maintained apart from the metadata configuration.

> but I don't think that works because of the race condition. The metadata's not in place as a service to be able to use it to feed rules for filtering metadata.

I don't know what race condition you're referring to. Is there an
existing jira issue that tracks this?

> The main purpose for this was to allow third party signed metadata statements as an alternative to tagging entities.

Yes, I see how that would be useful. The entity containing the
<md:AffiliationDescriptor> role could be signed by the third party.

I asked about this because I'm searching for a scalable "no touch"
method for local management of metadata obtained from remote sources
(such as federations). Affiliation lists can be maintained locally and
provisioned to IdP systems in the same way that local entity metadata
is provisioned into a sourceDirectory of a
LocalDynamicMetadataProvider.

Tom