Accessing RequestedAttributes in MappedEntityAttribute

[Vlad Mencl]

Hi,

We've been experimenting with changes in our IdP config, adding 
activationConditions to DataConnector definitions (such as "StoredId") 
to suppress generating the values when the attribute is not needed.

Primary motivation is reducing dependency on database availability, but 
also avoids storing values that were never shared externally.

For samlPairwiseID, this was quite straightforward to accomplish with 
the MappedEntityAttributes predicate bean [1], passing it the subject-id 
Entity attributes (values "pairwise-id" and "any") as Tag Candidates.


We found this task tricky for regular attributes requested via a 
RequestedAttribute element in the SP metadata.

We could not find a pre-defined condition that would evaluate whether 
the SP metadata has a specific RequestedAttribute (equivalent of 
attribute-filter AttributeInMetadata rule).


However, through experimentation, we found that the 
MappedEntityAttributes predicate also responds to Tag Candidates 
matching the SAML2 names of RequestedAttribute entries from the SP metadata.


I could not find anything in the IdP documentation that would explicitly 
document this behaviour, though the Attribute Registry documentation [2]
mentions "mapping of SAML [...] into internal data, such as in the case 
of <RequestedAttribute> elements in SAML metadata".


Can someone please confirm whether this (MappedEntityAttributes 
responding to Tag Candidates with names of RequestedAttributes) is 
expected / documented behaviour?


Many thanks in advance for a reply.


Best regards,
Vlad



[1] 
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3214770177/MappedEntityAttributePredicate
[2] 
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510514/AttributeRegistryConfiguration

Our configuration:
* in global.xml

     <bean id="samlPairwiseIDInMetadata" 
parent="shibboleth.Conditions.EntityDescriptor">
         <constructor-arg name="pred">
             <bean parent="shibboleth.Conditions.MappedEntityAttributes">
             <constructor-arg>
                 <list>
                 <bean parent="shibboleth.TagCandidate"
  
c:name="urn:oasis:names:tc:SAML:profiles:subject-id:req"
                     p:values="pairwise-id" />
                 <bean parent="shibboleth.TagCandidate"
  
c:name="urn:oasis:names:tc:SAML:profiles:subject-id:req"
                     p:values="any" />
                 </list>
             </constructor-arg>
             </bean>
         </constructor-arg>
     </bean>

     <bean id="sharedTokenInMetadata" 
parent="shibboleth.Conditions.EntityDescriptor">
         <constructor-arg name="pred">
             <bean parent="shibboleth.Conditions.MappedEntityAttributes">
               <constructor-arg>
                   <list>
                    <bean parent="shibboleth.TagCandidate"
                   c:name="urn:oid:1.3.6.1.4.1.27856.1.2.5" />
                   </list>
               </constructor-arg>
           </bean>
         </constructor-arg>
     </bean>

* in attribute-resolver.xml

     <DataConnector id="PairwiseIDConnector" xsi:type="StoredId"
         activationConditionRef="samlPairwiseIDInMetadata"  ...

     <DataConnector id="sharedToken"
         activationConditionRef="sharedTokenInMetadata"
         exportAttributes="auEduPersonSharedToken"
         ...

* in conf/attributes/custom/auEduPersonSharedToken.rule
id=auEduPersonSharedToken
transcoder=SAML2StringTranscoder
saml2.name=urn:oid:1.3.6.1.4.1.27856.1.2.5
saml2.encodeType=False
displayName.en=Shared token


-- 
Vladimir Mencl
Lead Software Engineer

Research & Education
Advanced Network NZ Ltd

E  vladimir.mencl at reannz.co.nz
www.reannz.co.nz