Research and Scholarship and filter by relying party

[Cantor, Scott]

On 3/4/14, 2:28 PM, "Jeffrey Crawford" <jeffreyc at ucsc.edu> wrote:

>I hope I'm just missing something simple here. We have based our
>Shibboleth configuration to communicate with SP's based on inCommon
>EntityID's in the relying-party configuration file. We
> now want to support Research and Scholarship and have set up the filter
>but I can't seem to find a way to have the relying-party part allow
>Research and Scholarship in.

If you're trying to actually disallow use of the IdP, you don't generally
do that by creating RP entries, you should probably look at filtering the
metadata itself.

>I've used EntitiesDescriptor to group non inCommon metadata before, but
>InCommon hasn't grouped these SP's into an EntitiesDescriptor group that
>is specific to Research and Scholarship.

Groups based on file containment are very problematic for a variety of
reasons, so you won't find them practical going forward.

>Is there some other mechanism I can use or do I need to change our config
>from relying-party based to filter based?

There isn't anything supported in V2 that handles entity attribute policy
filtering except the attribute filter. I don't think you could manage to
add tag filtering to the RelyingParty lookup code very easily, and it's
not really pluggable, but it could be done.

An easier plugin approach would be a metadata filter plugin that filters
based on entity attributes, but there isn't one built-in to V2. It isn't a
very large amount of work.

-- Scott