IdP - EntityAttributes - Predicate - Regex filter for federation SPs

Tom Scavo trscavo at
Fri Jul 13 08:38:34 EDT 2018

On Fri, Jul 13, 2018 at 7:47 AM, Martin Lunze
<martin.lunze at> wrote:
> I have changed my config now to use one single LocalDynamicMetadataProvider
> instead of one separatly FilesystemMetadataProvider for every SP.
>>         <MetadataProvider id="LOCALMD"
>>                 xsi:type="LocalDynamicMetadataProvider"
>>                 sourceDirectory="%{idp.home}/metadata/local">
>>                 <MetadataFilter xsi:type="EntityAttributes">
>>                         <saml:Attribute
>> Name=""
>> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>> <saml:AttributeValue></saml:AttributeValue>
>>                         </saml:Attribute>
>> <ConditionRef>always-true</ConditionRef>
>>                 </MetadataFilter>
>>         </MetadataProvider>

Martin, this is a great example. Would you mind adding it to the
EntityAttributesFilter [1] wiki page?

Here's a tip for the archive. Instead of referencing an external bean
with <ConditionRef>, in V3.4 one can use <ConditionScript> as well:

        (function (entity) { return true; }(input));

This does the same thing as your external bean "always-true" but an
inline script leads to a self-contained example that is more

> Works great and should be a bit less work for me for the future, because i
> did not have to write all the necessary config if a new SP occurs.

Yes, that is why LocalDynamicMetadataProvider is recommended. (Archive
readers should refer to the MetadataManagementBestPractices [2]

> Still saving his metadata in the directory and give it the name of the
> SHA1-Hash of the depending entityID.
> Still looks a bit strange, all this hashes in the directory :-)

May I ask what tools are you using to manage the files in the sourceDirectory?

Thanks Martin.


[1] EntityAttributesFilter
[2] MetadataManagementBestPractices

More information about the users mailing list