SP - attribute-policy.xml - filter by entity?

[Douglas Spooner]

Hi Scott/Peter

Thanks for the replies. I'm still a shib noob so apologies if I'm getting terminology wrong and causing confusion!

@Scott: I spoke with the 4th federation and I think it was a translation issue as now its clarified that they are only releasing 4 values (faculty, student, staff, other) & not requiring us to ignore some if sent.  I'll ask them about the misuse you pointed out.

@Peter: They pay to access our content but they tell us what users of their organisation can have access to the content from what I've been told. I like the idea of the entitlement attribute this could be better than what we are doing at the moment. I'll mention it at the next update meeting.

Thanks

Doug

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 21 December 2011 15:59
To: users at shibboleth.net
Subject: Re: SP - attribute-policy.xml - filter by entity?

On 12/21/11 10:39 AM, "Douglas Spooner" <spoonerd at rsc.org> wrote:

>But I¹ve come across an issue that I need some help on please. One 
>federations I¹m in the process of integrating with only wants us to 
>accept certain values for eduPersonAffiliation

Leaving aside whether that makes sense (I would say not), it isn't necessarily the case that you would have to use the filter for that. More to the point, there is no real way to do this based on "federation".
There's no notion of such a thing in the software, or in metadata, so there's nothing you could filter on. Specific IdPs, yes, but that's not "a federation", and you certainly wouldn't want to list them all.

> 
>For Example
> 
>Fed 1,2,3 want us to accept faculty, student, staff, member, employee.
>Fed 4 wants us to only accept faculty, student, staff

Then Fed 4 should tell its IdPs to only send those values. That's also a misuse of member. Any time you send any of those values, you have to send member. And you should be able to assume that. We are trying to clear that up in the definition at the moment (not us, but MACE-Dir).

> 
>I figured it might be possible to do something similar like I did with 
>the credential resolver & relyingparty for specific federations. (all 
>had different rules about cert expiry etc)

Anything you did there is probably not really per-fderation. You wouldn't use the EntitiesDescriptor for that, if that's what you were doing. We pretty much wish we hadn't ever supported that approach, it will completely fall apart with changes to how metadata is handled, interfederation, etc.

> 
>Is it possible in the attribute-policy.xml to setup a rule to filter by 
>the entity descriptor name & if so how?

Yes, but that's per IdP, not per federation. Per IdP rules can be done a number of ways, among them creating a policy with a requirement rule based on AttributeIssuerString and then putting whatever attribute rules you want in that policy.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

DISCLAIMER:

This communication (including any attachments) is intended for the use of the addressee only and may contain confidential, privileged or copyright material. It may not be relied upon or disclosed to any other person without the consent of the RSC. If you have received it in error, please contact us immediately. Any advice given by the RSC has been carefully formulated but is necessarily based on the information available, and the RSC cannot be held responsible for accuracy or completeness. In this respect, the RSC owes no duty of care and shall not be liable for any resulting damage or loss. The RSC acknowledges that a disclaimer cannot restrict liability at law for personal injury or death arising through a finding of negligence. The RSC does not warrant that its emails or attachments are Virus-free: Please rely on your own screening. The Royal Society of Chemistry is a charity, registered in England and Wales, number 207890 - Registered office: Thomas Graham House, Science Park, Milton Road, Cambridge CB4 0WF