<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 6/26/18 5:17 PM, Tom Scavo wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAEtu=dMDd8gvqXHNsjKXDzH5GBfLsGEjdf7c01UnLxHBozjONA@mail.gmail.com"><br>
<pre wrap="">
Do you agree? Are the above filters equivalent?
</pre>
</blockquote>
<br>
No, per what Scott said.<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dMDd8gvqXHNsjKXDzH5GBfLsGEjdf7c01UnLxHBozjONA@mail.gmail.com"><br>
<pre wrap="">I wondered about that. To that end, how would you encode the following
role descriptor in a <RetainedRole> element?
<md:RoleDescriptor xsi:type="query:AttributeQueryDescriptorType"></pre>
</blockquote>
<br>
You would just use the QName of the xsi:type rather than the QName
of the element. So:<br>
<br>
<tt><RetainedRole>query:AttributeQueryDescriptorType</RetainedRole></tt><tt><br>
</tt><br>
<pre wrap="">
</pre>
<blockquote type="cite"
cite="mid:CAEtu=dMDd8gvqXHNsjKXDzH5GBfLsGEjdf7c01UnLxHBozjONA@mail.gmail.com">
<pre wrap="">
I'm confused. The EntityRoleWhiteList filter above effectively removes
all entities that do not contain an md:SPSSODescriptor role, right?
Specifically, the filter removes entire entities, it does not remove
individual roles. (If I'm wrong about that, I'm way off base.)</pre>
</blockquote>
<br>
As Scott said, you're off base, it removes RoleDescriptors.<br>
<br>
In case it's not obvious: The whole point of this filter is to
remove roles that are not relevant to the consuming entity. For
example, if you're an SP or discovery service, you likely only care
about IDPSSODescriptors (if SP, maybe also
AttributeAuthorityDescriptors). So you'd be interested in removing
all SPSSODescriptor and other roles. If the removal of roles from
an entity results in an entity with no roles, there's generally no
point in keeping the entity around. Unless you need to support
consuming AffiliationDescriptors, in which case you should set the
flag to not remove roleless EntityDescriptors. As you pointed out,
all entities with AffiliationDescriptors are by definition roleless.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dMDd8gvqXHNsjKXDzH5GBfLsGEjdf7c01UnLxHBozjONA@mail.gmail.com">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">If you are filtering roles AND also actively using AffiliationDescriptors,
then the above conditional about only caring about whitelisted roles isn't
true, so you'd want to set 'removeRolelessEntityDescriptors' to false to
retain EntityDescriptors which don't have a whitelisted role but do have an
AffiliationDescriptor.
</pre>
</blockquote>
<pre wrap="">
An entity can't have both, so again I'm confused.</pre>
</blockquote>
<br>
You're right, I spoke too quickly. A single entity can't have both
role(s) and AffiliationDescriptor. But you certainly can have a
multitude of entities with one case or the other being processed by
the same filter.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dMDd8gvqXHNsjKXDzH5GBfLsGEjdf7c01UnLxHBozjONA@mail.gmail.com">
<pre wrap=""> I don't see any
purpose for removeRolelessEntityDescriptors.
</pre>
</blockquote>
<br>
Hopefully the clarification that the fundamental functionality of
the filter is to remove role descriptors makes the purpose more
clear.<br>
</body>
</html>