Metadata Merge Facility

[Marvin Addison]

We've drunk the "metadata driven" philosophy that is facilitated with
IdPv3, but we've run into a problem: we drive many of our attribute release
policies with entity attributes that we can't control in some metadata
sources. We're using the metadata filter approach today to apply the
attributes after the metadata is loaded from the source:

<MetadataFilter xsi:type="EntityAttributes">
  <saml:Attribute Name="http://login.vt.edu/attribute/bundle">
    <saml:AttributeValue>http://login.vt.edu/attribute/bundle/vtid
</saml:AttributeValue>
  </saml:Attribute>
  <Entity>https://foo.example.edu/shibboleth</Entity>
</MetadataFilter>

That configuration is in metadata-providers.xml, which isn't subject to the
hot reload facility that we have grown to love in IdPv3. Besides, it
defeats the strategy of moving the most common configuration points solely
into metadata.

What I'd like to do is define stub metadata entries that have the needed
attributes in a metadata source I control and have it merged with the
canonical entry from another source. I guess you'd need a couple of
different merge strategies (append and replace at a minimum), but it seems
like it would solve my problem in a way that preserves the operational goal
of being entirely metadata driven. Is that a good idea? Have I missed an
obvious alternative solution that's available today?

Thanks,
Marvin from Virginia Tech
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170718/5334df7d/attachment.html>