<solution>Re: Technique to blacklist/suppress entities from an aggregate using metadatafilters?

[Chris Phillips]

Thanks, this is exactly what I was looking for.

FWIW, the example on the PredicateMetadataFilter page has an extra item
that didn't validate for me with the error:
UndeclaredPrefix: Cannot resolve 'metadata:Predicate' as a Name:

I removed 'metadata:' and it does properly validate that I can tell.

My metadata aggregate entry looks like this:


<MetadataProvider id="URLexample"
xsi:type="FileBackedHTTPMetadataProvider"
xmlns="urn:mace:shibboleth:2.0:metadata"
 metadataURL="http://example.com/aggregate.xml"
 backingFile="/opt/shibboleth-idp/metadata/aggregate.xml"
 maxRefreshDelay="PT1H">
                 <MetadataFilter xsi:type="SignatureValidation"
xmlns="urn:mace:shibboleth:2.0:metadata" requireSignedRoot="true"
                   
certificateFile="/opt/shibboleth-idp/credentials/md-signer.crt"/>
        <MetadataFilter xsi:type="Predicate" direction="exclude"
removeEmptyEntitiesDescriptors="false" trim="true">
                <Entity>https://example.org/shibboleth</Entity>
        </MetadataFilter>
         </MetadataProvider>


If you see anything out of place, let me know.  I don't know if I should
set removeEmptyEntitiesDescriptors to true or not so left it as as shown
in the  existing example.
If the above is valid, it would help to place it in as a simple example as
compared to the compound one.

Many thanks for making this just a configuration!


Chris.


On 2016-08-09, 4:48 PM, "users on behalf of Cantor, Scott"
<users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>> However, I can't find any syntax to support it and was looking here:
>> 
>>https://wiki.shibboleth.net/confluence/display/IDP30/MetadataFilterPlugin
>
>Child page, I'll clarify that it can allow/deny on the parent page, I'm
>sure that isn't clear.
>
>https://wiki.shibboleth.net/confluence/display/IDP30/PredicateMetadataFilt
>er
>
>> If there is a way to do this, I'm interested to hear how others have
>>done it
>> without dismantling and manipulating the aggregate at the IdP.
>> Given IdP-79 appears to be done, I'm hoping that this is just missing
>> documentation :)
>
>Just missing examples. The Predicate filter can do arbitrary conditions,
>but it has built-in syntax wired up to do basic matching by
>Entity/Group/Tag.
>
>If you can't deduce an example, let me know and I'll have to work on one.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net