IdP attribute filter strategy

[Jeffrey Crawford]

My goal is to use entity attributes to determine which attributes are
released. For my locally managed metadata I
 just add the EntityAttributes to our copy of the metadata.

For incommon I'm trying to use the metadata filter as described to
"virtually" add these same attributes so they trigger the attribute filter
rules based on the entityID's (This is only done to entities that don't
request attributes) Each attribute value will trigger a particular filter
rule. This all works just fine as long as my metadata filter looks like:

        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="urn:mace:ucsc.edu:filter">
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-1</saml:AttributeValue>
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-2</saml:AttributeValue>
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-3</saml:AttributeValue>
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-4</saml:AttributeValue>
            <Entity>https://some.sp1.example.com/shibboleth</Entity>
            <Entity>https://some.sp2.example.com/shibboleth</Entity>
        </MetadataFilter>

However the above forces me to make bundles or at worst an entry for each
SP that needs special attributes (These are mostly UC apps in which we need
to trade UC wide specific attributes)

What I want to do is have rules look like:
        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="urn:mace:ucsc.edu:filter">
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-1</saml:AttributeValue>
            <Entity>https://some.sp1.example.com/shibboleth</Entity>
        </MetadataFilter>

        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="urn:mace:ucsc.edu:filter">
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-2</saml:AttributeValue>
            <Entity>https://some.sp1.example.com/shibboleth</Entity>
            <Entity>https://some.sp2.example.com/shibboleth</Entity>
        </MetadataFilter>

        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="urn:mace:ucsc.edu:filter">
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-3</saml:AttributeValue>
            <Entity>https://some.sp1.example.com/shibboleth</Entity>
        </MetadataFilter>

        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute Name="urn:mace:ucsc.edu:filter">
                <saml:AttributeValue>urn:mace:ucsc.edu:
attr-4</saml:AttributeValue>
            <Entity>https://some.sp1.example.com/shibboleth</Entity>
            <Entity>https://some.sp2.example.com/shibboleth</Entity>
        </MetadataFilter>

That way sp1 would have attr-1 attr-2 attr-3 and attr-4 be released, where
sp2 only gets attr-2 and attr-4. However it behaves as though only the
first match wins, the others don't have attributes added that then match to
attribute filters.

Just to be clear, the first example works beautifully and does what I'm
telling it to but sp2 is getting attr-1 and attr-3 where it's not needed,
or even unwanted. The latter example just needs me to add an entityID per
variable that I want released.

In short I'm trying to avoid having lots of custom attribute filters and
rely more on metadata to determine what attributes are released.

Jeffrey
​
<jeffreyc at ucsc.edu>

Both pilots and IT professionals require training and currency before
charging into clouds!
---------------------------------------

On Mon, Jun 8, 2015 at 12:34 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/8/15, 3:31 PM, "users on behalf of Jeffrey Crawford" <
> users-bounces at shibboleth.net on behalf of jeffreyc at ucsc.edu> wrote:
>
> >I've been testing using the IdP "consent" page observing the attributes
> before they are sent. I'll go ahead and file a bug
>
> Do you mean you're attempting to configure a relying party override based
> on the tag?
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150608/f308ae8a/attachment.html>