IdP attribute filter strategy

[Jeffrey Crawford]

So I tried something that didn't work and am wondering if perhaps maybe
this should actually be able to augment existing EntityAttributes.

For example the following, only adds the "first" entry "attr1" to the
metadata. If you wanted filtering done on an attribute by attribute basis
then the following doesn't work:

        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="attr-name">
                <saml:AttributeValue>attr1</saml:AttributeValue>
            </saml:Attribute>
            <Entity>https://sp.example.com/shibboleth</Entity>
        </MetadataFilter>

        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="attr-name">
                <saml:AttributeValue>attr2</saml:AttributeValue>
            </saml:Attribute>
            <Entity>https://sp.example.com/shibboleth</Entity>
        </MetadataFilter>

However combining it into a single rule does work:

        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="attr-name">
                <saml:AttributeValue>attr1</saml:AttributeValue>
                <saml:AttributeValue>attr2</saml:AttributeValue>
           </saml:Attribute>
            <Entity>https://sp.example.com/shibboleth</Entity>
        </MetadataFilter>


Jeffrey E. Crawford
ITS Application Administrator (IdM)
831-459-4365
jeffreyc at ucsc.edu

Both pilots and IT professionals require training and currency before
charging into clouds!
---------------------------------------

On Sun, Jun 7, 2015 at 1:54 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/6/15, 10:51 AM, "users on behalf of Tom Scavo" <
> users-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:
> >
> >I would never publish an entity descriptor with two entity attributes
> >having the same name (that's very tacky :) but since this metadata is
> >being produced and consumed by the Shibboleth SP, I think that's a
> >perfectly okay thing to do.
>
> This is the IdP, not the SP. And it's not produced at all, it's an
> internal extension to in-memory information.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150608/722f4eaf/attachment.html>