InCommon AttributeFilterPolicy PolicyRequirementRule?

[Baron Fujimoto]

This is what I ended up doing as well. On the Slack channel, Scott Cantor
confirmed that the "registered-by-incommon" value is what defines the InC
Federation membership. Since this was not the case here, I decided to just
treat them as a standalone entity even though we could potentially get
their metadata via InC, in order to avoid a potentially confusing mix of
configs.

On Mon, May 1, 2023 at 6:37 AM Kevin Foote <kevin.foote at colorado.edu> wrote:

> Hello Baron,
>
> I’m not sure if “recommended practice” fits how we handle / deal with
> these issues but, locally we end up making a specific filter for entities
> or SPs that fall into scenarios such as the one you describe.
>
> thanks
> - kevin.foote
>
>
>
>
>
>
> > On Apr 28, 2023, at 8:19 PM, Baron Fujimoto via users <
> users at shibboleth.net> wrote:
> >
> > [External Email - Use caution]
> >
> > I've received some additional information from the SP. They advise, "...
> we are not direct members of InCommon but members of the CAF Federation.
> CAF, publishes their members to eduGain (a global federation), and InCommon
> pulls in OffCampus Partners metadata from eduGain". So perhaps this
> explains their lack of the elements we rely on for InC membership, but I'm
> not sure how we should handle this in a way that leverages the InC metadata
> source?
> >
> > On Fri, Apr 28, 2023 at 2:55 PM Baron Fujimoto <baron at hawaii.edu> wrote:
> > Can anyone provide a pointer to the current recommended practice for an
> AttributeFilterPolicy  PolicyRequirementRule for the InCommon Federation?
> My searches at incommon.org and shibboleth.net have been unsuccessful.
> >
> > The InCommon AttributeFilterPolicy for InCommon we have carried forward
> over many upgrades is:
> >
> >     <AttributeFilterPolicy id="InCommon_Federation">
> >         <PolicyRequirementRule xsi:type="AND">
> >                 <Rule xsi:type="EntityAttributeExactMatch"
> >                         attributeName="
> http://macedir.org/entity-category"
> >                         attributeValue="
> http://id.incommon.org/category/registered-by-incommon" />
> >                 <Rule xsi:type="RegistrationAuthority"
> >                         registrars="https://incommon.org" />
> >         </PolicyRequirementRule>
> >         ...
> >
> > Where I think we expect something like the following in the entity's InC
> metadata:
> >
> >   <Extensions>
> >     <mdrpi:RegistrationInfo
> xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi" registrationAuthority="
> https://incommon.org"/>
> >     <mdattr:EntityAttributes
> xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
> >       <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
> Name="http://macedir.org/entity-category"
> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> >         <saml:AttributeValue>
> http://id.incommon.org/category/registered-by-incommon
> </saml:AttributeValue>
> >       </saml:Attribute>
> >     </mdattr:EntityAttributes>
> >   </Extensions>
> >
> > However, we have now encountered an SP (entityID="
> https://login.offcampuspartners.com") that is in the InC metadata, but
> for which these requirements are not present. I think this is the first
> time we've encountered issues with these conditions. But maybe we should be
> doing this differently now?
> >
> > Any suggestions would be appreciated.
> > --
> > Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
> > minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
> >
> >
> > --
> > Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
> > minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
> > --
> > For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>

-- 
Baron Fujimoto <baron at hawaii.edu> ::: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum descendus pantorum
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230503/6f158c24/attachment.htm>