SP - attribute-policy.xml - filter by entity?

[Cantor, Scott]

On 12/21/11 10:39 AM, "Douglas Spooner" <spoonerd at rsc.org> wrote:

>But I¹ve come across an issue that I need some help on please. One
>federations I¹m in the process of integrating with only wants us to
>accept certain values for eduPersonAffiliation

Leaving aside whether that makes sense (I would say not), it isn't
necessarily the case that you would have to use the filter for that. More
to the point, there is no real way to do this based on "federation".
There's no notion of such a thing in the software, or in metadata, so
there's nothing you could filter on. Specific IdPs, yes, but that's not "a
federation", and you certainly wouldn't want to list them all.

> 
>For Example
> 
>Fed 1,2,3 want us to accept faculty, student, staff, member, employee.
>Fed 4 wants us to only accept faculty, student, staff

Then Fed 4 should tell its IdPs to only send those values. That's also a
misuse of member. Any time you send any of those values, you have to send
member. And you should be able to assume that. We are trying to clear that
up in the definition at the moment (not us, but MACE-Dir).

> 
>I figured it might be possible to do something similar like I did with
>the credential resolver & relyingparty for specific federations. (all had
>different rules about cert expiry etc)

Anything you did there is probably not really per-fderation. You wouldn't
use the EntitiesDescriptor for that, if that's what you were doing. We
pretty much wish we hadn't ever supported that approach, it will
completely fall apart with changes to how metadata is handled,
interfederation, etc.

> 
>Is it possible in the attribute-policy.xml to setup a rule to filter by
>the entity descriptor name & if so how?

Yes, but that's per IdP, not per federation. Per IdP rules can be done a
number of ways, among them creating a policy with a requirement rule based
on AttributeIssuerString and then putting whatever attribute rules you
want in that policy.

-- Scott