AW: Disable attribute filtering

[Bachl, Mathias]

Hi,

unfortunately AttributeFilterPolicy is a final class, not an interface :-(

The only thing I can imagine using a custom-initiated AttributeFilterPolicy instance would be to dynamically generate a list of AttributeRules based on the attribute registry configuration - again a very hacky solution...

Best regards,
Mathias

-----Ursprüngliche Nachricht-----
Von: Cantor, Scott <cantor.2 at osu.edu> 
Gesendet: Mittwoch, 15. Februar 2023 14:16
An: Bachl, Mathias <mathias.bachl at brz.gv.at>; Shib Users <users at shibboleth.net>
Betreff: Re: Disable attribute filtering

> I wouldn't mind implementing such a dummy filtering service, 
> AttributeFilter implementation or AttributeFilterServiceStrategy, but 
> I didn't find a way to replace the default implementations defined in services-system.xml...
> Is there a way to do that?

Probably only to a point with some of the services. The filter and resolver services happen to not define much of anything in their "system" resources, which gets automatically injected into the Spring context (in contrast to e.g. the relying-party resolver, which has dozens of built-in beans defining part of the service).

Replacing the existing filter policy file with a native Spring bean file that instantiated a custom built AttributeFilterPolicy-supporting object will cause the existing service to instantiate that bean or beans, pull out that implementation of the AttributeFilterPolicy interface, and wrap the AttributeFilterServiceImpl class around it.

Nothing stops a custom implementation of AttributeFilterPolicy from doing anything it wants to.

You could also do all this with the existing filter syntax but only by authoring schema, writing Spring parsers, etc, which is largely pointless.

There should be a more elegant way to replace services wholesale, but it's just not in enough demand.

-- Scott