Bypass attribute release consent for some SPs

[Simone Avogadro]

Thanks Scott!
  I've gone for the group since we want to remove the filter only for a
selected set of SPs whose metadata is collected in a file we manage
ourselves
  I've also tried to apply the "tag" way but didn't find a way to add the
tag to all the SPs from out metadata, here the section so maybe you can
give us a suggestion for the future:

 thanks again!

     <MetadataProvider id="PolimiMetadata"
backingFile="%{idp.home}/metadata/localCopyFromInnerMeta.xml"
metadataURL="https://outsite.it/ShibbolethMetadata/inner-metadata.jsp"
xsi:type="FileBackedHTTPMetadataProvider"
minRefreshDelay="PT1M"
maxRefreshDelay="PT4M"
>

        <MetadataFilter xsi:type="EntityRoleWhiteList">
            <RetainedRole>md:SPSSODescriptor</RetainedRole>
        </MetadataFilter>

<!-- Simone -->
        <MetadataFilter xsi:type="EntityAttributes">
   <saml:Attribute Name="https://idp.polimi.it/internalSP">
       <saml:AttributeValue>INTERNAL</saml:AttributeValue>
   </saml:Attribute>
   <Entity>*</Entity>
</MetadataFilter>
<!-- /Simone -->

    </MetadataProvider>


     -Simone


2015-10-28 18:48 GMT+01:00 Cantor, Scott <cantor.2 at osu.edu>:

> On 10/28/15, 1:39 PM, "users on behalf of Simone Avogadro" <
> users-bounces at shibboleth.net on behalf of simone.avogadro at gmail.com>
> wrote:
>
>
>
> >Hi everyone,
> >   at a quick glance I don't seem to find a way to enable attribute
> release consent only for some SPs.
> >  Namely we have 2 different metadata provider:
> > - external: we want the attribute release to be shown
> > - internal: the user already gave us a broad consent and we don't want
> to show any more requests
>
> You can't base it on metadata source directly. You can use
> EntitiesDescriptor Name as the basis of a group-based predicate or you can
> do something more general with EntityAttributes in the metadata, which is
> known as a tag-based predicate. That would require adding a MetadataFilter
> to the metadata providers that attaches a custom EntityAttribute to each
> entity when the metadata is loaded. Groups are much simpler, but much less
> general and highly dependent on control of the metadata sources.
>
> Either way, the most common places to apply the condition are in a
> RelyingParty override that enables or disables the specific intercept to
> run or by attaching it as an activationCondition to the intercept flow
> descriptor bean for the attribute consent flow. The descriptors are in
> intercept/profile-intercept.xml
>
> >   I guess this is a pretty common scenario but I missed the setting to
> configure this. Anyone so kind to provide some pointers to speedup the
> process?
>
> There are examples on RelyingParty overrides and ActivationConditions in
> the wiki.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151104/69836a10/attachment-0001.html>