Can the MDA add entity attributes?

[Wessel, Keith]

Thanks, Ian. I actually hammered at this long enough that I figured it out last week. Pretty nifty new stuff in 0.10.0!

Now, I have another odd problem. I've been signing my metadata with xmlsectool for over a decade. I'm now trying to sign it with the MDA. Using the same key and cert pair that I've been using with xmlsectool, the MDA is signing it, but signature validation with anything (xmlsectool, the IdP, etc.) is failing. Any thoughts on why based on this limited information or suggestions how I might go about troubleshooting this further?

Thanks,
Keith


From: Ian Young <ian at iay.org.uk>
Sent: Tuesday, September 10, 2024 10:19 AM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Can the MDA add entity attributes?

Once more, with less embedded junk:


On 30 Aug 2024, at 15:45, Wessel, Keith via users <users at shibboleth.net> wrote:

I think the answer is yes, but only if I do some complicated custom coding to make it happen. But I'm hoping I'm missing something. Can the MDA consume metadata and add entity attributes to specific entities before outputting it?

Sorry, I missed this when it came in so this reply is rather delayed. I hope it's still relevant.

In 0.9.x and earlier, this could be a bit tricky, as you imply. I used XSL transforms in many cases, but that's not for everyone. So, MDA 0.10.0 added a stage specifically for this use case. From the release notes:

https://shibboleth.atlassian.net/wiki/spaces/MA1/pages/1495859647/Version+0.10.x


  *   MDA-56<https://issues.shibboleth.net/jira/browse/MDA-56>: A new stage EntityAttributeAddingStage has been added to add entity attributes to the metadata for SAML entities. This is configured using attributeName, attributeNameFormat and attributeValue properties, with attributeName and attributeNameFormat defaulting to the values required to add an entity category attribute. The stage is based on a new Container framework which attempts to generate reasonably well formatted XML for nested container elements, and handles the insertion of the required parent containers (Extensions, EntityAttributes, Attribute) when they are not already present.

So, it's a lot more straightforward now. If you need more information, let me know more about what you're trying to do and I'll think about adding to the examples.

Cheers,

    -- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240910/1f23d16f/attachment.htm>