example of <DiscoveryFilter>

[Cantor, Scott]

On 2/11/14, 5:16 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 2/11/14, 4:19 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>>
>>>That's helpful, thanks. If I wanted to whitelist additional entities
>>>(in addition to those above), I would just add one or more
>>><RelyingParty> elements.
>
>I'd go so far as to say I don't think that's representable.
>
>The only way that would conceivably work is an ugly workaround, you could
>actually two separate MetadataProviders for the same source, and apply two
>different DiscoveryFilter whitelists to each one that didn't overlap. The
>second source would only be used to supply the discovery feed, it would
>never come into play for anything else.

Actually, there is another that was more "intended" for this kind of
thing, which I forgot, my brain isn't in an SP place these days. The basic
idea in 2.5 was that everything was to be based off tags. So if you don't
have a tag that applies to your use case, the way to fix that is by
applying an EntityAttributes filter to the metadata itself. This is a
plugin that actually *adds* a tag you define to the metadata itself on the
fly. Then you can set downstream policy based off that tag.

So in this case, you'd use an EntityAttributes metadata filter to populate
your "extra" stragglers with the tag you want to filter on for discovery.

There's an example filter here, near the end:
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataFilter

-- Scott