Can the MDA add entity attributes?

[Ian Young]

> On 11 Sep 2024, at 17:13, Wessel, Keith via users <users at shibboleth.net> wrote:
> 
> In fact, my pipeline is doing exactly as you described, and upgrading to 1.0.0 fixes the issue.

That's good news, however you choose to proceed.


> Now, I need your advice on how to move forward for production. Would you trust 1.0.0 in a production run for gathering and publishing metadata at this point?

I'd be very confident about that specific snapshot, because I know that the only substantive change from 0.10.0 right now is that one bugfix. That won't always be the case, though (for example, at some point all of the deprecated code will be removed), so there's going to be a risk to using a snapshot that has by definition not been qualified or tested except through our internal CI.

So it's one of those things where what I would do or trust personally isn't the issue. I can't make guarantees about the use of a snapshot and whether the risk is acceptable is something you'd need to determine.


> Or would you recommend I stick with 0.10.0 and try to get the XSL transform to work around the issue? If the latter, I could use some advice on instantiating the XSL transform stage. Unlike other stages, I can't fine any fields in the Javadoc for that class to guide me on properties to pass into a bean that uses that stage. Can you perhaps give me an example of an XSL transform that I could run that would work around the signing problem while not making a significant change to my metadata? You mentioned an identity transform, but I'm afraid I'm not quite XML-savvy enough do know what I'm doing.

This is the safer route. It's what we are doing in the UKf production deployment today under 0.10.0, in our per-entity metadata generation pipeline (the normal pipeline does enough XSL stuff in passing so it's not needed).

Your transformation bean would look like this:

<bean parent="mda.XSLTransformationStage"
    p:XSLResource="classpath:identity.xsl"/>

If you apply that at any point after the disassembly, but before the signature (so either before or after the reassembly would work, I think).

The identity.xsl file in question is this one:

https://github.com/ukf/ukf-meta/blob/master/mdx/identity.xsl

XSL is something of an acquired taste.

Cheers,

	-- Ian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4151 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240911/4dab746a/attachment.p7s>