Central discovery service filter by role?

[Cantor, Scott]

> "NOTE that the resulting metadata has to include any SP which may need
> service from this DS."

It has to unless you disable the endpoint checking that it uses to restrict where to return the user. Among other things that prevents it from being an open redirector, but if you had to, you could disable that.

> Is there a way to white list by 'role' a la IdP EntityRoleWhiteList for SPs?

No. In most cases that filter is only useful for reducing memory footprint, so I'm not sure it does what you think it does.

> Possible to build the union of two white list Filter's (alls SPs and
> explicit IdPs)?

No.
 
-- Scott