InCommon AttributeFilterPolicy PolicyRequirementRule?

[Kevin Foote]

Hello Baron, 

I’m not sure if “recommended practice” fits how we handle / deal with these issues but, locally we end up making a specific filter for entities or SPs that fall into scenarios such as the one you describe. 

thanks
- kevin.foote






> On Apr 28, 2023, at 8:19 PM, Baron Fujimoto via users <users at shibboleth.net> wrote:
> 
> [External Email - Use caution]
> 
> I've received some additional information from the SP. They advise, "... we are not direct members of InCommon but members of the CAF Federation. CAF, publishes their members to eduGain (a global federation), and InCommon pulls in OffCampus Partners metadata from eduGain". So perhaps this explains their lack of the elements we rely on for InC membership, but I'm not sure how we should handle this in a way that leverages the InC metadata source?
> 
> On Fri, Apr 28, 2023 at 2:55 PM Baron Fujimoto <baron at hawaii.edu> wrote:
> Can anyone provide a pointer to the current recommended practice for an AttributeFilterPolicy  PolicyRequirementRule for the InCommon Federation? My searches at incommon.org and shibboleth.net have been unsuccessful.
> 
> The InCommon AttributeFilterPolicy for InCommon we have carried forward over many upgrades is:
> 
>     <AttributeFilterPolicy id="InCommon_Federation">
>         <PolicyRequirementRule xsi:type="AND">
>                 <Rule xsi:type="EntityAttributeExactMatch"
>                         attributeName="http://macedir.org/entity-category"
>                         attributeValue="http://id.incommon.org/category/registered-by-incommon" />
>                 <Rule xsi:type="RegistrationAuthority"
>                         registrars="https://incommon.org" />
>         </PolicyRequirementRule>
>         ...
> 
> Where I think we expect something like the following in the entity's InC metadata:
> 
>   <Extensions>
>     <mdrpi:RegistrationInfo xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" registrationAuthority="https://incommon.org"/>
>     <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
>       <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
>         <saml:AttributeValue>http://id.incommon.org/category/registered-by-incommon</saml:AttributeValue>
>       </saml:Attribute>
>     </mdattr:EntityAttributes>
>   </Extensions>
> 
> However, we have now encountered an SP (entityID="https://login.offcampuspartners.com") that is in the InC metadata, but for which these requirements are not present. I think this is the first time we've encountered issues with these conditions. But maybe we should be doing this differently now?
> 
> Any suggestions would be appreciated.
> -- 
> Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
> 
> 
> -- 
> Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
> minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net