Central discovery service filter by role?

[Wessel, Keith]

We used to have a similar set-up when we ran a discovery service for all of the CIC schools' IDPs. We wanted  only their IDPs.

Short of what Scott suggested, you're right: it'll take some code. But the code isn't at all difficult. For us, it was a fairly simple Perl script that read the InCommon metadata and a file containing a list of whitelisted IDPs. There's a little parsing magic involved, but it's not rocket science.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Poage
Sent: Wednesday, June 25, 2014 7:29 PM
To: Shib Users
Subject: Central discovery service filter by role?

I'm exercising the central discovery service (1.2.1) and attempting to white list all SPs and a select handful of IdPs from a single/common
(remote) metadata source. Cf. wayfconfig.xml

"NOTE that the resulting metadata has to include any SP which may need service from this DS."

Is there a way to white list by 'role' a la IdP EntityRoleWhiteList for SPs?

>     <metadata:MetadataFilter xsi:type="metadata:EntityRoleWhiteList">
>       <metadata:RetainedRole>samlmd:SPSSODescriptor</metadata:RetainedRole>
>     </metadata:MetadataFilter>

Not seeing anything I can recognize in the source, so guessing code might be required.

Possible to build the union of two white list Filter's (alls SPs and explicit IdPs)?

Doesn't look like the following works:

<MetadataProvider identifier=... url=... backingFile=...>
  <Filter identifier="white1" ...
  <Filter idenfifier="white2" ...

Or maybe there's a filter chaining entity in there (can't seem to find guidance in the .xsd's).

Thanks for any guidance on this!
Tom.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net