modularize attribute bundles in an AttributeFilterPolicy?

[Tom Scavo]

On Fri, Feb 26, 2016 at 3:10 PM, Nate Klingenstein <ndk at sudonym.me> wrote:
>
> I feel like the same need has been somewhat met by expanding
> (SAML) metadata with things like entity categories.

I think this is a very important point.

Baron, I'm not sure exactly what you're trying to do but let's do a
thought experiment and see if entity attributes help. Since you
support the Research & Scholarship Category, you already have a policy
rule based on entity attributes in your config, which looks something
like this:

<!-- for Shib IdP V3, use type saml:EntityAttributeExactMatch instead -->
<afp:PolicyRequirementRule
xsi:type="saml:AttributeRequesterEntityAttributeExactMatch"
      attributeName="http://macedir.org/entity-category"
      attributeValue="http://refeds.org/category/research-and-scholarship"/>

(You don't have *exactly* this rule in your config since you don't yet
support global R&S but you get the idea :)

That one policy rule covers a lot of ground since *entity attributes*
are more general than *entityIDs*. You could eliminate a lot of
redundancy in your config if you could arbitrarily label SP entity
descriptors with entity attributes of your choosing. Well, the good
news is that you can do that :-)

https://wiki.shibboleth.net/confluence/display/IDP30/EntityAttributesFilter

Using the EntityAttributesFilter, tag the SPs that get a particular
bundle with a specific entity attribute and then refer to that entity
attribute in your attribute release policy.

Tom