IdP attribute filter strategy

[Tom Scavo]

On Thu, Jun 4, 2015 at 8:30 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 6/5/15, 12:22 AM, "Jeffrey Crawford" <jeffreyc at ucsc.edu> wrote:
>
>>It sounds intriguing. Do you have an example of how it would be
>>configured?
>
> I can get something once I'm online for longer, I'm on vacation for a bit.
> I think Tom Scavo actually asked me about this filter and might have an
> example somewhere.

Yes, here it is:

<!-- add an R&S entity attribute to one or more entity descriptors -->
<MetadataFilter type="EntityAttributes">
    <saml:Attribute
            Name="http://macedir.org/entity-category-support"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue>http://id.incommon.org/category/research-and-scholarship</saml:AttributeValue>
    </saml:Attribute>

    <Entity>https://identityprovider.anl.gov/idp/shibboleth</Entity>
    <!-- append as many IdP entityIDs as desired -->
</MetadataFilter>

If you include the above filter in your MetadataProvider, it will add
the given entity attribute to every entity listed. The use case here
is an R&S SP wanting to create a custom discovery interface consisting
of all the R&S IdPs as well as a number of non-R&S IdPs. Here is a
more complete example:

<!-- add an R&S entity attribute to one or more entity descriptors -->
<MetadataFilter type="EntityAttributes">
    <saml:Attribute
            Name="http://macedir.org/entity-category-support"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue>http://id.incommon.org/category/research-and-scholarship</saml:AttributeValue>
    </saml:Attribute>

    <Entity>https://identityprovider.anl.gov/idp/shibboleth</Entity>
    <!-- append as many IdP entityIDs as desired -->
</MetadataFilter>

<!-- consume only InCommon metadata -->
<MetadataFilter type="Whitelist" matcher="EntityAttributes">
    <saml:Attribute
            Name="http://macedir.org/entity-category"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue>http://id.incommon.org/category/registered-by-incommon</saml:AttributeValue>
    </saml:Attribute>
</MetadataFilter>

<!-- expose all R&S IdPs registered by InCommon on the discovery
interface -->
<DiscoveryFilter type="Whitelist" matcher="EntityAttributes">
    <saml:Attribute
            Name="http://macedir.org/entity-category-support"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue>http://id.incommon.org/category/research-and-scholarship</saml:AttributeValue>
    </saml:Attribute>
    <saml:Attribute
            Name="http://macedir.org/entity-category-support"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
    </saml:Attribute>
</DiscoveryFilter>

The above is for an SP. As an IdP operator, your goal should be to use
only entity attributes (not entityIDs) to configure attribute release
policy. If your IdP supports R&S, it already releases the R&S
attribute bundle to R&S SPs based on an entity attribute. Does that
bundle of attributes show up elsewhere in your attribute release
policy? If so, you have a potential application of the above filter.

More generally, review your attribute release policy to see if there
are other sets of attributes used frequently. If so, define your own
R&S-like category and use the above technique to collapse all those
policy rules down to one.

Tom