Attribute filtering fails with IssuerRegistrationAuthority policy

[Geoffroy ARNOUD]

Hi

I fail in making attribute filtering working with IssuerRegistrationAuthority policy, on IDP 4.1.

I use LocalDynamicMetadataProvider metadata provider, instead of FileBackedHTTPMetadataProvider to limit memory consumption.
The individual metadata files are generated the same way we do for our SP servers. A sample md file is attached.

My attritute-filter is as follows: 

<AttributeFilterPolicyGroup id="FederationsFilterPolicy"
        xmlns="urn:mace:shibboleth:2.0:afp"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">

        <AttributeFilterPolicy id="releaseToFederatedSPs">

            <PolicyRequirementRule xsi:type="IssuerRegistrationAuthority" registrars="https://federation.renater.fr/"/>

            <AttributeRule attributeID="commonName">
              <PermitValueRule xsi:type="AttributeInMetadata" onlyIfRequired="true"/>
            </AttributeRule>

            <!-- Many other AttributeRule statements -->
        </AttributeFilterPolicy>
</AttributeFilterPolicyGroup>

When trying to resolve attributes with aacli, I get the following in Shib logs:

2021-04-26 11:05:51,247 - 127.0.0.1 - DEBUG [net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AbstractRegistrationAuthorityPolicyRule:121] - Attribute Filter '/AttributeFilterPolicyGroup:FederationsFilterPolicy/PolicyRequirementRule:_2c0b946f21a4d392ab248b90a9cb6505': Filtering on registration, but no peer metadata available
2021-04-26 11:05:51,248 - 127.0.0.1 - DEBUG [net.shibboleth.idp.attribute.filter.policyrule.saml.impl.AbstractRegistrationAuthorityPolicyRule:156] - Attribute Filter '/AttributeFilterPolicyGroup:FederationsFilterPolicy/PolicyRequirementRule:_2c0b946f21a4d392ab248b90a9cb6505': The peer's metadata did not contain a RegistrationInfo descriptor
2021-04-26 11:05:51,248 - 127.0.0.1 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeFilterPolicy:128] - Attribute Filter Policy 'releaseToFederatedSPs'  Policy is not active for this request

I can confirm that the SP metadata is perfectly readable. I succeeded with the following policies:
- Requester
- EntityAttributeExactMatch

<PolicyRequirementRule xsi:type="Requester" value="https://test-sp.federation.renater.fr" />

and

<PolicyRequirementRule xsi:type="EntityAttributeExactMatch"
               attributeName="http://macedir.org/entity-category"
               attributeValue="https://federation.renater.fr/category/metier"/>

Both make filtering releasing expected attributes.

Am I missing something?

Best regards

Geoffroy

-------------- next part --------------
A non-text attachment was scrubbed...
Name: aea7b14bf1151f82921cc4b629adeecdddf6aef7.xml
Type: application/xml
Size: 21681 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210426/c334a2dc/attachment.wsdl>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2241 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210426/c334a2dc/attachment.p7s>