modularize attribute bundles in an AttributeFilterPolicy?

[cneberg]

I don't know if this is good idea, but it works in my tests on IDP v3.
Define a DOCTYPE at the top of the attribute-filter.xml and include the
ENTITY which includes another file with the xml block  you want to
duplicate.    Then further down reference that entity in XML.   It's the
equivalent of copying and pasting the same block of XML everywhere you put
the entity reference.

attribute-filter.xml

<!DOCTYPE root
[
  <!ENTITY extra-attributes SYSTEM "extra-attributes.xml">
]>


<afp:AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
        xmlns:afp="urn:mace:shibboleth:2.0:afp"
        xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
        xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp
http://shibboleth.net/schema/idp/shibboleth-afp.xsd
                            urn:mace:shibboleth:2.0:afp:mf:basic
http://shibboleth.net/schema/idp/shibboleth-afp-mf-basic.xsd
                            urn:mace:shibboleth:2.0:afp:mf:saml
http://shibboleth.net/schema/idp/shibboleth-afp-mf-saml.xsd">
...
<afp:AttributeFilterPolicy id="releaseTest">
   <afp:PolicyRequirementRule xsi:type="basic:OR">
         <basic:Rule xsi:type="basic:AttributeRequesterString" value="
https://test.example.com/shibboleth" />
   </afp:PolicyRequirementRule>

    &extra-attributes;

<afp:AttributeRule attributeID="uid">
      <afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>

</afp:AttributeFilterPolicy>

extra-attributes.xml (in the conf directory with the attribute-filter.xml
file)

<afp:AttributeRule attributeID="cn">
      <afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>

<afp:AttributeRule attributeID="telephoneNumber">
     <afp:PermitValueRule xsi:type="basic:ANY" />
</afp:AttributeRule>

On Fri, Feb 26, 2016 at 1:46 PM, cneberg <cneberg at gmail.com> wrote:

> Can you use an xml entity in config files?  If so that might solve the cut
> and paste issue.
>
> Christopher
>
>
> On Friday, February 26, 2016, Baron Fujimoto <baron at hawaii.edu> wrote:
>
>> On Fri, Feb 26, 2016 at 09:43:50AM -0000, Rod Widdowson wrote:
>> >> Is there a way to make an IdP AttributeFilterPolicy more modular by
>> >> defining a named attribute bundle and then incorporating and possibly
>> >> supplementing it in a particular AttributeFilterPolicy?
>> >
>> >I see exactly what you mean (and why) but No.
>> >
>> >The (implied) namespaces for attributes are already complicated enough
>> that
>> >I wouldn't want to add them.
>> >
>> >For completeness I'll mention that the attribute filter language does
>> have
>> >hooks to allow PolicyRequirementRules to be shared, but it was only
>> (badly
>> >&) partially implemented in V2 and we have withdrawn support in V3 (it
>> turns
>> >out that the semantics become almost impossible).
>> >
>> >So I'm afraid that cut & paste is your friend.
>> >If you feel strongly you could pop in an RFE to make PolicyRequirementRef
>> >work.  But it may well be a breaking change (at the edges) and so that
>> would
>> >need to wait for 4.0.
>>
>> Ok, thanks. I mainly wanted to make sure I wasn't missing an opportunity
>> to factor this out and perhaps simplify the configs. I think it would be
>> useful, for all the usual reasons you might want to factor something like
>> that out, but understand if it's not cards for the foreseeable future.
>>
>> -baron
>> --
>> Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
>> minutas cantorum, minutas balorum, minutas carboratum desendus pantorum
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160226/f539625a/attachment.html>