Building a composite attribute from sets of attributes

[Etienne Dysli Metref]

Hi devs,

Here's another crazy SWITCH edu-ID extension that we would like to pull
off. We want to build a kind of composite attribute whose value is
composed of one or more sets of attributes, a bit like if you were
sending attributes for two different users without mixing them. If we
serialise this as JSON, the attribute value would look something like:

[
  {
    "eduPersonUniqueId": "1234 at uniA.example.org",
    "eduPersonAffiliation": "staff",
    "idp": "https://uniA.example.org/idp/shibboleth",
    ...
  },
  {
    "eduPersonUniqueId": "5678 at uniB.example.org",
    "eduPersonAffiliation": "student",
    "idp": "https://uniB.example.org/idp/shibboleth",
    ...
  }
]

I imagine this would need two separate attribute resolutions to fetch
the two sets for 1234 at uniA.example.org and 5678 at uniB.example.org without
mixing the attribute values together. We also want to filter those
attributes according to the policy set for IdP A and IdP B,
respectively, so two different filtering passes would be needed as well.

Is there a way to realise this with the current (3.4) IdP API?
I looked at classes in idp-attribute-filter-api and
idp-attribute-resolver-api modules and thought we'd need to implement
net.shibboleth.idp.attribute.filter.Matcher to do our special filtering,
but that's just a first guess.

This is starting to sound like OIDC's aggregated claims. If you plan to
implement that in the future, the same mechanism could be reused...

Cheers,
   Etienne

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20190725/2446d679/attachment.sig>