Relying party override for anything from ukfederation MDQ

[James Potter]

Hi all,

I'm setting up a Shibboleth IdP (4.3.1), I'd like to show the consent form for any service from UK federation/inCommon etc (ie anything from the uk federation aggregate) but not bilateral services.

I'm using the MDQ service.

The plan - add a MetadataFilter element in metadata-providers.xml - this works:

    <MetadataProvider id="ukfMDQ" xsi:type="DynamicHTTPMetadataProvider">
        <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
                certificateFile="%{idp.home}/credentials/ukfederation-mdq.pem" />
        <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D" />
        <MetadataFilter xsi:type="EntityAttributes">
            <saml:Attribute
                    NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
                    Name=http://shibboleth.net/ns/profiles/securityConfiguration>
                <saml:AttributeValue>uk.ac.xxx.showConsent</saml:AttributeValue>
            </saml:Attribute>
            <Entity>https://test.ukfederation.org.uk/entity</Entity<https://test.ukfederation.org.uk/entity%3c/Entity>>
        </MetadataFilter>
        <MetadataQueryProtocol>http://mdq.ukfederation.org.uk/</MetadataQueryProtocol<http://mdq.ukfederation.org.uk/%3c/MetadataQueryProtocol>>
    </MetadataProvider>

And I can reference it in a relying party override:

        <bean id="consentForUKFed" parent="RelyingPartyByTag">
            <constructor-arg name="candidates">
                <list>
                   <bean parent="TagCandidate"
                            c:name=http://shibboleth.net/ns/profiles/securityConfiguration
                            p:values="uk.ac.xxx.showConsent"/>
                </list>
           </constructor-arg>

What I can't work out is how to make this apply to all entityIDs - the example above only works for the uk fed test sp (entityID specified).. If I remove the <Entity> element, it stops working for any entityID.

<Entity>.*</Entity> doesn't work.

Any clues how to get this working? Or alternative approaches to try?

Thanks,

Jim Potter
Technical Consultant and Support specialist,
Trust and Identity Team,
[cid:image001.png at 01D987E2.1474FC30]<http://www.jisc.ac.uk/>
4 Portwall Lane
Bristol BS1 6NB
United Kingdom
Team: 01235 822185

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230516/aad695cb/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 1320 bytes
Desc: image001.png
URL: <http://shibboleth.net/pipermail/users/attachments/20230516/aad695cb/attachment.png>