Applying filters to metadata

[Max Spicer]

I'm looking at using entity attributes in our metadata so the first step
for me is to set up filters to remove untrusted attributes from remote
metadata. Our current configuration is a combination
of FilesystemMetadataProvider and FileBackedHTTPMetadataProvider for
unfederated metadata, and a DynamicHTTPMetadataProvider for federation
metadata. These are all combined with a single ChainingMetadataProvider in
a fairly standard (if slightly old fashioned) way.

I want to apply the filter to remove untrusted entity attributes in as few
places as possible so my initial thoughts are to introduce
more ChainingMetadataProviders in order to group types of metadata
providers and then apply the filter to those. This would look something
like this:

   - Top-level ChainingMetadataProvider
      - ChainingMetadataProvider containing the local metadata providers
         - FilesystemMetadataProvider1
         - FilesystemMetadataProvider2
         - ...
      - ChainingMetadataProvider containing the remote metadata providers
         - MetadataFilter to remove entity attributes
         - FileBackedHTTPMetadataProvider1
            - optional MetadataFilter to add attributes etc
         - FileBackedHTTPMetadataProvider2
         - DynamicHTTPMetadataProvider for the federation MDQ service

With this sort of setup, will the filters get applied as I expect, and in
such a way that attributes are removed before the filters that add our own?

Thanks,

Max Spicer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230127/0797bec9/attachment.htm>