<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 6/26/18 12:25 PM, Tom Scavo wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAEtu=dP281Kx9s-o2e8Pw2HrQMHY6RQjKiu7TLStHjn2_ie2LA@mail.gmail.com">
<pre wrap="">
</pre>
<pre wrap="">
But there are two completely different types of entity descriptor (as
you know). Either the entity contains one or more role descriptors or
the entity contains a single affiliation descriptor.</pre>
</blockquote>
<br>
Yes. AffiliationDescriptor is not a (subtype of) RoleDescriptor,
and that's how the nested <choice> elements in the
EntityDescriptor define things.<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dP281Kx9s-o2e8Pw2HrQMHY6RQjKiu7TLStHjn2_ie2LA@mail.gmail.com">
<pre wrap=""> So the question
is: Should this filter completely ignore the latter?</pre>
</blockquote>
<br>
It does completely ignore any AffiliationDescriptor if present. IIRC
I didn't write it - I think Chad did. But IMHO that's correct given
its purpose. It's the EntityRoleFilter (in OpenSAML) and the
EntityRoleWhiteList in the IdP schema. It's right there in the
names. It's about roles. AffiliationDescriptor is not a role.<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dP281Kx9s-o2e8Pw2HrQMHY6RQjKiu7TLStHjn2_ie2LA@mail.gmail.com"><br>
<pre wrap="">To summarize: This filter excludes ALL entities that contain an
affiliation descriptor (which is the opposite of what it should do).</pre>
</blockquote>
<br>
No, it does not fundamentally do anything with respect to
presence/absence of an AffiliationDescriptor, period. It doesn't
even look at it.<br>
<br>
And technically the filter doesn't fundamentally "exclude"
entities. Its purpose is to remove from entities (subtypes of)
RoleDescriptors which aren't in the supplied whitelist.<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dP281Kx9s-o2e8Pw2HrQMHY6RQjKiu7TLStHjn2_ie2LA@mail.gmail.com">
<pre wrap="">
What about the removeRolelessEntityDescriptors attribute? What is the
filter's working definition of "roleless entity descriptor?"</pre>
</blockquote>
<br>
"Roleless" means it doesn't contain any subtypes of the
RoleDescriptor interface. In schema terms it means it doesn't
contain any elements which are effectively subtypes of
md:RoleDescriptorType, which are essentially the ones in the first
inner <choice> in the EntityDescriptor schema (which for the
record also effectively includes extensions of RoleDescriptorType,
like the concrete subtypes of QueryDescriptorType defined in the
post 2.0 extension):<br>
<br>
<tt> <choice></tt><tt><br>
</tt><tt> <b> <choice maxOccurs="unbounded"></b></tt><b><tt><br>
</tt></b><b><tt> <element
ref="md:RoleDescriptor"/></tt></b><b><tt><br>
</tt></b><b><tt> <element
ref="md:IDPSSODescriptor"/></tt></b><b><tt><br>
</tt></b><b><tt> <element
ref="md:SPSSODescriptor"/></tt></b><b><tt><br>
</tt></b><b><tt> <element
ref="md:AuthnAuthorityDescriptor"/></tt></b><b><tt><br>
</tt></b><b><tt> <element
ref="md:AttributeAuthorityDescriptor"/></tt></b><b><tt><br>
</tt></b><b><tt> <element
ref="md:PDPDescriptor"/></tt></b><b><tt><br>
</tt></b><b><tt> </choice></tt></b><tt><br>
</tt><tt> <element
ref="md:AffiliationDescriptor"/></tt><tt><br>
</tt><tt> </choice></tt><tt><br>
</tt><br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dP281Kx9s-o2e8Pw2HrQMHY6RQjKiu7TLStHjn2_ie2LA@mail.gmail.com">
<pre wrap="">In any
case, why does this filter care about this?
</pre>
</blockquote>
<br>
Do you mean why does it have an option to remove an EntityDescriptor
which doesn't have one of the whitelisted roles? Presumably if you
only want to care about (and retain) certain whitelisted roles, then
an EntityDescriptor that contains none of those is of no interest to
you and is just taking up space, so might as well get rid of it.<br>
<br>
If you are filtering roles AND also actively using
AffiliationDescriptors, then the above conditional about only caring
about whitelisted roles isn't true, so you'd want to set
'removeRolelessEntityDescriptors' to false to retain
EntityDescriptors which don't have a whitelisted role but do have an
AffiliationDescriptor.<br>
<br>
</body>
</html>