Filter attribute release depending on CAS service groups

[Andrew Morgan]

On Fri, 30 Jun 2017, David Huebner wrote:

>
>>> InEntityGroup does not seem to work and RequesterRegex does seem to
>>> have the problem, that it potentially also applies to all SAML SPs with 
>>> such
>>> an entityID.
>> I was under the impression that the CAS code was mocking up metadata 
>> objects that would include the bits sufficient to make InEntityGroup work. 
>> If not, it's probably possible to enhance that.
> Well, the first Rule works (i.e. my client gets attributes), while the second 
> one does not:
>
> attribute-filter.xml
> <!--<Rule xsi:type="Requester" 
> value="https://shibidp-cas.example.prj/casclient/" />-->
> <Rule xsi:type="InEntityGroup" value="institutional-services" />
>
> cas-protocol.xml:
> <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
>  c:regex="https:.*"
>  p:group="institutional-services"
>  p:authorizedToProxy="false"
>  p:singleLogoutParticipant="true"/>
>
> And thats the only ServiceDefinition for now, so there are no conflicts of 
> any sort here.
>
> So, if anyone got a working solution for this, I'd appreciate it ;)

Here you go:

     <!-- common attributes released to most services -->
     <AttributeFilterPolicy id="cas-standard-attributes">
         <PolicyRequirementRule xsi:type="OR">
             <Rule xsi:type="InEntityGroup" groupID="standard-attributes" />
             <Rule xsi:type="InEntityGroup" groupID="accessible-learning" />
             <Rule xsi:type="InEntityGroup" groupID="degreeworks" />
             <Rule xsi:type="InEntityGroup" groupID="eecs-capstone" />
             <Rule xsi:type="InEntityGroup" groupID="engr-3d-printing" />
             <Rule xsi:type="InEntityGroup" groupID="touchnet" />
         </PolicyRequirementRule>

         <!-- old CAS attributes -->
         <AttributeRule attributeID="uid">
             <PermitValueRule xsi:type="ANY"/>
         </AttributeRule>

...

     </AttributeFilterPolicy>


 	Andy