IdP attribute filter strategy

[Jeffrey Crawford]

Thanks, it does appear to be documented but I didn't know what to look for.
Thanks for pointing that out.

One thing I noticed, I think, is that metadata that already contains
something like:
    <mdattr:EntityAttributes
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
      <saml:Attribute Name="urn:mace:ucsc.edu:metadata:attr:profile"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

and you then make a rule in the metadata filter like:
        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="urn:mace:ucsc.edu:metadata:attr:profile">

The filter will not augment existing AttributeValues in the metadata. Not
really a problem in the real world but I noticed it while testing and
wanted to point that out just in case someone ran into it thinking it
wasn't working at all.

Jeffrey <jeffreyc at ucsc.edu>

Both pilots and IT professionals require training and currency before
charging into clouds!
---------------------------------------

On Fri, Jun 5, 2015 at 5:57 AM, Tom Scavo <trscavo at gmail.com> wrote:

> On Thu, Jun 4, 2015 at 8:30 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> > On 6/5/15, 12:22 AM, "Jeffrey Crawford" <jeffreyc at ucsc.edu> wrote:
> >
> >>It sounds intriguing. Do you have an example of how it would be
> >>configured?
> >
> > I can get something once I'm online for longer, I'm on vacation for a
> bit.
> > I think Tom Scavo actually asked me about this filter and might have an
> > example somewhere.
>
> Yes, here it is:
>
> <!-- add an R&S entity attribute to one or more entity descriptors -->
> <MetadataFilter type="EntityAttributes">
>     <saml:Attribute
>             Name="http://macedir.org/entity-category-support"
>             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>         <saml:AttributeValue>
> http://id.incommon.org/category/research-and-scholarship
> </saml:AttributeValue>
>     </saml:Attribute>
>
>     <Entity>https://identityprovider.anl.gov/idp/shibboleth</Entity>
>     <!-- append as many IdP entityIDs as desired -->
> </MetadataFilter>
>
> If you include the above filter in your MetadataProvider, it will add
> the given entity attribute to every entity listed. The use case here
> is an R&S SP wanting to create a custom discovery interface consisting
> of all the R&S IdPs as well as a number of non-R&S IdPs. Here is a
> more complete example:
>
> <!-- add an R&S entity attribute to one or more entity descriptors -->
> <MetadataFilter type="EntityAttributes">
>     <saml:Attribute
>             Name="http://macedir.org/entity-category-support"
>             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>         <saml:AttributeValue>
> http://id.incommon.org/category/research-and-scholarship
> </saml:AttributeValue>
>     </saml:Attribute>
>
>     <Entity>https://identityprovider.anl.gov/idp/shibboleth</Entity>
>     <!-- append as many IdP entityIDs as desired -->
> </MetadataFilter>
>
> <!-- consume only InCommon metadata -->
> <MetadataFilter type="Whitelist" matcher="EntityAttributes">
>     <saml:Attribute
>             Name="http://macedir.org/entity-category"
>             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>         <saml:AttributeValue>
> http://id.incommon.org/category/registered-by-incommon
> </saml:AttributeValue>
>     </saml:Attribute>
> </MetadataFilter>
>
> <!-- expose all R&S IdPs registered by InCommon on the discovery
> interface -->
> <DiscoveryFilter type="Whitelist" matcher="EntityAttributes">
>     <saml:Attribute
>             Name="http://macedir.org/entity-category-support"
>             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>         <saml:AttributeValue>
> http://id.incommon.org/category/research-and-scholarship
> </saml:AttributeValue>
>     </saml:Attribute>
>     <saml:Attribute
>             Name="http://macedir.org/entity-category-support"
>             NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>         <saml:AttributeValue>
> http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
>     </saml:Attribute>
> </DiscoveryFilter>
>
> The above is for an SP. As an IdP operator, your goal should be to use
> only entity attributes (not entityIDs) to configure attribute release
> policy. If your IdP supports R&S, it already releases the R&S
> attribute bundle to R&S SPs based on an entity attribute. Does that
> bundle of attributes show up elsewhere in your attribute release
> policy? If so, you have a potential application of the above filter.
>
> More generally, review your attribute release policy to see if there
> are other sets of attributes used frequently. If so, define your own
> R&S-like category and use the above technique to collapse all those
> policy rules down to one.
>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150605/0951427e/attachment.html>