IdP 3 configuration strategy

[Youssef Ghorbal]

Hello lits,

	I just want to have your advice on a configuration strategy I want to set up.
	The IdP will be used for some internal SPs and be part of a Federation.
	The idea is to be able to have diffrent behaviours for internal SPs and “federated” ones. For example :
	- Release “personal” attributes systematically to all internal SPs (and not for the others)
	- Require user concent for attribute release for external SPs and not the internal ones.
	- …

	At first, I was thinking using “regex” matching on EntityIDs since all internal SPs use a naming policy, and attribute filters are regex friedly (out of the box) but RelyingPartyOverrides are not (out of the box I mean) some users in the mailing list have some leads to acheive this but it’s not straight forward.

	What I think doing is using Metadatfilter (EntityAttributes) to add a custom tag for internal SPs and filter on it. Attribute policies AND RelyingPartyOverrides can handle this out of the box. The only “gotcha" is that for every MetadataProvider entry in metadata-providers.xml (regarding an internal SP) I have to specify something like that

<MetadataFilter xsi:type="EntityAttributes">
 <saml:Attribute Name="https://sp.example.org/internalSPs">
  <saml:AttributeValue>true</saml:AttributeValue>
 </saml:Attribute>
</MetadataFilter>
    
	It's something I can live with.

	Am I on the right track ? Any feedback is welcome !

Youssef Ghorbal