idpv3 attribute-resolver + PluginActivationConditions

Jarno Huuskonen jarno.huuskonen at
Mon Aug 31 03:07:26 EDT 2015


(Thanks to everyone for help !)

On Thu, Aug 27, Cantor, Scott wrote:
> On 8/27/15, 9:13 AM, "users on behalf of Rod Widdowson" <users-bounces at on behalf of rdw at> wrote:
> >Answering the technical side only
> >
> >> Is possible to use ExternalAttributePluginActivationConditions
> >> (shibboleth.Conditions.RelyingPartyId)
> >> (
> >> ginActivationConditions)
> >> with "RelyingPartyByGroup" ?
> >
> And of course I echo all the cautions, you should not use RelyingPartyByGroup except to reference groups maintained in local aggregates that you control.
> In most cases, what you should use is an EntityAttribute metadata filter to "auto-tag" entities in a metadata feed with an entity attribute, and then apply a condition to that tag, but likewise I didn't predefine that as a bean.

So something like this would tag all entityIDs in metadata:
<MetadataFilter xsi:type="EntityAttributes">
  <saml:Attribute Name="">

<bean id="tagall" factory-method="alwaysTrue" class=""/>

> You're welcome to file a request to have beans added to handle those cases more easily. Might already be one filed, I didn't look.

I didn't find one with "EntityAttribute" in idp (IDP-734, IDP-739 are
not usable with attribute resolver ?)


Jarno Huuskonen

More information about the users mailing list