include statements in xml configuration files?

[Wessel, Keith]

Metadata filters by reference... brilliant! Thanks for that! I really had no idea about that.

Compiling and building the regex into a custom object... This would essentially be baking it into a jar file added to idp.war, correct? If we choose to go this route, does anyone have any pointers on where to start with that?

I assume just making it an external bean included by reference in the metadata filter rather than an in-line script isn't going to make it any more efficient, right? It actually has to be a compiled object.

Frankly, it might not be worth it. We're talking about a metadata provider that reloads every 15 minutes or so. I assume it would have to build that regex for each SP in the metadata, not once per metadata refresh, correct? But we're not talking about having to run it thousands or even hundreds of times per minute. So, though it adds load theoretically, it might be an acceptable loadin this case.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, February 19, 2021 1:56 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: include statements in xml configuration files?

On 2/19/21, 2:39 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    I think I follow you here. You're saying externally generate a file 
> that contains a metadata entity attribute filter with the right XML 
> bits in it to add the entity attributes to the specified entity IDs then include it by reference in the metadata provider block.

It's outside-in, there is nothing in the metadata provider, that's the point of it.

> What would the XML look like in the metadata provider block to attach a metadata filter by reference?

Nothing there, the separate file is all there is.

<MetadataFilter xsi:type="ByReference">
	 <MetadataFilters providerRef="InCommonMD">
		<MetadataFIlter ... />
		<MetadataFIlter ... />
	</MetadataFilters>
</MetadataFilter>

https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/display/IDP4/ByReferenceFilter__;!!DZ3fjg!t4VZFbgyub8t-DpsKv37K2nc_B8QT2WnnnXqPN4HjM6bSWatUY4Gfvd3gGnL2Lp_mw$ 

> Of course, the beauty of the regex solution is, as long as you have a reliable regex pattern, it's a once and done.

I would do it that way, but that's just a special case.

> Like you said, the regex adds a little computing power as it has to be 
> built each time. There's not a way to avoid that while still using the regex, is there? I'm not thinking of one.

A Pattern can be built and compiled in a bean definition and injected into a script as a custom object, avoiding compiling it every time.

-- Scott


--
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!DZ3fjg!t4VZFbgyub8t-DpsKv37K2nc_B8QT2WnnnXqPN4HjM6bSWatUY4Gfvd3gGnX2SCWwQ$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net