Shibboleth-DS source - <wayf:HideFromWAYF>

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2015-04-29 15:33]:
> On 4/29/15, 1:20 PM, "Callum Smith" <callum at strubi.ox.ac.uk> wrote:
> >Has anyone managed to implement a version of the shibboleth-ds that 
> >respects the <wayf:HideFromWAYF> metadata tag?
> 
> I believe that is being replaced by a REFEDS-agreed-to entity
> category tag which the SP can filter on for you.

Indeed. I've written up a spec for REFEDS to basically replicate the
existing semantics and expected behaviour from the UK's metadata
extension as an Entity Category (Entity Attribute; see URL below), and
the UKfederation already publishes /both/ ways to signal that for
every affected entity.
I.e., every SAML IDP in the UKfederation metadata that has
<wayf:HideFromWAYF> set also includes the
http://refeds.org/category/hide-from-discovery
entity category.

The latest Shibboleth SP already ships with example configuration that
will hide such IDPs by default from the Shibboleth EDS.

So for the Shibboleth EDS (since you asked about idpselect.js) all
you'd need to do is a Shib 2.5 SP and the matching configuration
snipptet for your shibboleth2.xml. E.g. include the DiscoveryFilter
below as a child element of the MetadataProvider element that loads
the SAML metadata you want filtered that way:

<MetadataProvider ...>
  <MetadataFilter .../>
  <MetadataFilter .../>
  <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
    attributeName="http://macedir.org/entity-category"
    attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
    attributeValue="http://refeds.org/category/hide-from-discovery" />
</MetadataProvider ...>

No changes to the Shibboleth EDS required at all (or recommended).
-peter