Can the MDA add entity attributes?

[Wessel, Keith]

If you still care and if it helps, I was doing this after disassembly:

                <ref bean="validateSchema" />
                <ref bean="extractIDs"/>
                <ref bean="generateContentReferenceId"/>
This was done on four different inputs, only one of which was an <EntitiesDescriptor>. The other three are all single <EntityDescriptor> metadata sources. The <EntitiesDescriptor> source then undergoes some filtering out of specific SPs followed by some adding of entity attributes to what wasn'tfiltered out.

All four sources' pipelines are part of a mergeInputs stage. After merging, I then:

                <ref bean="buildEntitiesDescriptor"/>
                <ref bean="addValidUntil"/>
                <ref bean="signMetadata"/>

As I said, the only way I could get this to work was to do the XSL transform just before signing.

Hope that helps,
Keith


From: Ian Young <ian at iay.org.uk>
Sent: Thursday, September 12, 2024 8:03 AM
To: Shib Users <users at shibboleth.net>
Cc: Wessel, Keith <kwessel at illinois.edu>
Subject: Re: Can the MDA add entity attributes?




On 11 Sep 2024, at 22:08, Wessel, Keith via users <users at shibboleth.net<mailto:users at shibboleth.net>> wrote:

I added the xslTransform bean right after my disassemble, but that didn't do it. So, I added it just before my signMetadata stage. I actually converted my signMetadata stage to a simple pipeline that transforms and then signs. So, the transform happens all in one call, and I didn't have to go adding the transform stage to various pieces of the config. That did the trick. For the sake of the list archives, I recommend doing the transform as close to before the signing as possible.

That's interesting. The work I did figuring this out implied that the issue was being introduced during the disassembly stage, so logically any time after that would have been sufficient. Your result seems to imply that there's some other part of the framework that also potentially introduces the mismatch.

That actually makes me feel better about the way I addressed this for 1.0.0, as it's as part of the signing stage and should therefore cover all possible cases.

Cheers,

    -- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240912/b43e5d34/attachment.htm>