Can the MDA add entity attributes?

[Wessel, Keith]

Thanks, Ian. Yes, I've experienced XSL a few times with vended products. It's an incredibly useful and creative way to transform schemas, but you're correct: it's very much an acquired taste. "Useful" and "creative" go with a number of other less positive adjectives in this case.

I added the xslTransform bean right after my disassemble, but that didn't do it. So, I added it just before my signMetadata stage. I actually converted my signMetadata stage to a simple pipeline that transforms and then signs. So, the transform happens all in one call, and I didn't have to go adding the transform stage to various pieces of the config. That did the trick. For the sake of the list archives, I recommend doing the transform as close to before the signing as possible.

Thanks for the help with this, and I look forward to the release of 1.0.0 almost as much as I imagine you do!

Keith


-----Original Message-----
From: Ian Young <ian at iay.org.uk> 
Sent: Wednesday, September 11, 2024 12:00 PM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Can the MDA add entity attributes?



> On 11 Sep 2024, at 17:13, Wessel, Keith via users <users at shibboleth.net> wrote:
> 
> In fact, my pipeline is doing exactly as you described, and upgrading to 1.0.0 fixes the issue.

That's good news, however you choose to proceed.


> Now, I need your advice on how to move forward for production. Would you trust 1.0.0 in a production run for gathering and publishing metadata at this point?

I'd be very confident about that specific snapshot, because I know that the only substantive change from 0.10.0 right now is that one bugfix. That won't always be the case, though (for example, at some point all of the deprecated code will be removed), so there's going to be a risk to using a snapshot that has by definition not been qualified or tested except through our internal CI.

So it's one of those things where what I would do or trust personally isn't the issue. I can't make guarantees about the use of a snapshot and whether the risk is acceptable is something you'd need to determine.


> Or would you recommend I stick with 0.10.0 and try to get the XSL transform to work around the issue? If the latter, I could use some advice on instantiating the XSL transform stage. Unlike other stages, I can't fine any fields in the Javadoc for that class to guide me on properties to pass into a bean that uses that stage. Can you perhaps give me an example of an XSL transform that I could run that would work around the signing problem while not making a significant change to my metadata? You mentioned an identity transform, but I'm afraid I'm not quite XML-savvy enough do know what I'm doing.

This is the safer route. It's what we are doing in the UKf production deployment today under 0.10.0, in our per-entity metadata generation pipeline (the normal pipeline does enough XSL stuff in passing so it's not needed).

Your transformation bean would look like this:

<bean parent="mda.XSLTransformationStage"
    p:XSLResource="classpath:identity.xsl"/>

If you apply that at any point after the disassembly, but before the signature (so either before or after the reassembly would work, I think).

The identity.xsl file in question is this one:

https://github.com/ukf/ukf-meta/blob/master/mdx/identity.xsl

XSL is something of an acquired taste.

Cheers,

	-- Ian