SP Include MetadataFilter with MDQ

[Nate Klingenstein]

All,

I would like to be able to include a whitelist of providers from InCommon while using the MDQ protocol to fetch their actual metadata so that we don't load the metadata for all InCommon providers.  I used the following configuration:

<!-- InCommon Per-Entity Metadata Distribution Service -->
<MetadataProvider type="MDQ" id="incommon" ignoreTransport="true" cacheDirectory="inc-mdq-cache" 
    maxCacheDuration="86400" minCacheDuration="60"
    baseUrl="https://mdq.incommon.org/">
   <MetadataFilter type="Signature" certificate="inc-md-cert-mdq.pem"/>
   <MetadataFilter type="RequireValidUntil" maxValidityInterval="1209600"/>
   <MetadataFilter type="Include">
        <Include>https://redacted.org/sp</Include>
   </MetadataFilter>
</MetadataProvider>

This bombed with:

2021-04-01 16:00:29 INFO OpenSAML.MetadataProvider [1] [default]: applying metadata filter (Include)
2021-04-01 16:00:29 ERROR OpenSAML.MetadataProvider.Dynamic [1] [default]: error while resolving (https://redacted.org/sp): Include MetadataFilter instructed to filter the root/only entity in the metadata.
2021-04-01 16:00:29 WARN OpenSAML.MetadataProvider.Dynamic [1] [default]: next refresh of metadata for (https://redacted.org/sp) no sooner than 60 seconds
2021-04-01 16:00:29 WARN Shibboleth.SessionInitiator.SAML2 [1] [default]: unable to locate metadata for provider (https://redacted.org/sp)

Is the Include filter intended to work with the MDQ MetadataProvider?  I don't see anything in the documentation to indicate that this isn't possible.

https://wiki.shibboleth.net/confluence/display/SP3/MDQMetadataProvider
https://wiki.shibboleth.net/confluence/display/SP3/IncludeMetadataFilter

If not, is there a better way to whitelist specific providers from InCommon while retaining MDQ?  Am I going to have to fall back on the aggregate?

Thanks in advance,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id