breaking conf files down into smaller chunks

Liam Hoekenga liamr at umich.edu
Fri May 3 10:04:43 EDT 2013


We're considering breaking our conf files down into smaller chunks,
hoping that it will be safer / easier to manage if SP / organization /
federation specific filters are in their own conf files (and we only
edit the smaller conf file that we need).

There's some information in the wiki..

    https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttributeFilter#IdPAddAttributeFilter-LoadingMultiplePolicyGroupFiles

My thought is to put the new filters in a subdirectory under conf
(e.g. /opt/shibboleth-idp/conf/filters)
When we update shibboleth.AttributeFilterEngine Service block in
service.xml, is it possible to use a wild card in the
ConfigurationResource element...

    <ConfigurationResource
file="/opt/shibboleth-idp/conf/filter/*.xml"
xsi:type="resource:FilesystemResource" />

...or must you add a new entry for every new file?

Also, is it possible to break down the attribute resolvers into
separate files?   If so, can the AttributeDefinitions have
dependencies defined in separate files?

Liam


More information about the users mailing list