InCommon AttributeFilterPolicy PolicyRequirementRule?

[Baron Fujimoto]

I've received some additional information from the SP. They advise, "... we
are not direct members of InCommon but members of the CAF Federation. CAF,
publishes their members to eduGain (a global federation), and InCommon
pulls in OffCampus Partners metadata from eduGain". So perhaps this
explains their lack of the elements we rely on for InC membership, but I'm
not sure how we should handle this in a way that leverages the InC metadata
source?

On Fri, Apr 28, 2023 at 2:55 PM Baron Fujimoto <baron at hawaii.edu> wrote:

> Can anyone provide a pointer to the current recommended practice for an
> AttributeFilterPolicy  PolicyRequirementRule for the InCommon Federation?
> My searches at incommon.org and shibboleth.net have been unsuccessful.
>
> The InCommon AttributeFilterPolicy for InCommon we have carried forward
> over many upgrades is:
>
>     <AttributeFilterPolicy id="InCommon_Federation">
>         <PolicyRequirementRule xsi:type="AND">
>                 <Rule xsi:type="EntityAttributeExactMatch"
>                         attributeName="http://macedir.org/entity-category"
>                         attributeValue="
> http://id.incommon.org/category/registered-by-incommon" />
>                 <Rule xsi:type="RegistrationAuthority"
>                         registrars="https://incommon.org" />
>         </PolicyRequirementRule>
>         ...
>
> Where I think we expect something like the following in the entity's InC
> metadata:
>
>   <Extensions>
>     <mdrpi:RegistrationInfo
> xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" registrationAuthority="
> https://incommon.org"/>
>     <mdattr:EntityAttributes
> xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
>       <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> Name="http://macedir.org/entity-category"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>         <saml:AttributeValue>
> http://id.incommon.org/category/registered-by-incommon
> </saml:AttributeValue>
>       </saml:Attribute>
>     </mdattr:EntityAttributes>
>   </Extensions>
>
> However, we have now encountered an SP (entityID="
> https://login.offcampuspartners.com") that is in the InC metadata, but
> for which these requirements are not present. I think this is the first
> time we've encountered issues with these conditions. But maybe we should be
> doing this differently now?
>
> Any suggestions would be appreciated.
> --
> Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
>


-- 
Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230428/bae25026/attachment.htm>