Multiple <EntitiesDescriptor> in single metadata file

[Christopher Bland]

Hello all,

We have been deploying SPs on campus using a federation approach. As 
such we use AttributeRequesterInEntityGroup in our attribute-filter.xml 
file for attributes we send to all servers.  We are currently deploying 
a SP which is part of our federation but do not want to send it our 
standard attributes.  I have tried two approaches to the problem but 
both seem to give me errors.

First approach change attribute-filter.xml to

     <PolicyRequirementRule xsi:type="basic:AND">
         <basic:Rule xsi:type="basic:AttributeRequesterInEntityGroup" 
groupID="https://fdu.edu/metadata/federated-fdu.xml" />
         <basic:Rule xsi:type="basic:NOT">
         <basic:Rule xsi:type="basic:AttributeRequesterString" 
value="https://test.fdu.edu/shibboleth-sp" />
         </basic:Rule>
     </PolicyRequirementRule>

Second approach change our metadata file to have two 
<EntitiesDescriptor>.  Rather than create a separate metadata file for 
this host, I would rather use two <EntitiesDescriptor> it creates a 
manageable solutions that can be reused in the future.

metadata.xml

<?xml version="1.0" encoding="UTF-8"?>
<EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
Name="https://fdu.edu/metadata/federated-fdu.xml"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <EntityDescriptor>
          ....
       </EntityDescriptor>
</EntitiesDescriptor>
<EntitiesDescriptor
   xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
   Name="https://fdu.edu/metadata/other-fdu.xml"
   xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
   xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
      <EntityDescriptor>
          ....
       </EntityDescriptor>
</EntitiesDescriptor>

I would appreciate any feedback as well as feasibility of my approaches

Thank you in advance,

-Chris
-- 
OIRT Signature

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120925/357aba71/attachment.html