cas protocol metadata provider confusion

[Paul B. Henson]

On Fri, Aug 29, 2025 at 07:16:27PM +0000, Ray Bon via users wrote:

> What is the purpose of the MetadataFilter in this example?

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507218/EntityRoleFilter

"The EntityRole filter removes unwanted role descriptors from entity
metadata"

Basically the filter in this context removes any entries that don't have
an SPSSODescriptor element, which effectively only loads SP entries.
This is only an issue if you're loading metadata with mixed identity
providers and service providers, such as the legacy InCommon bulk
metadata. At the time an idp would save a lot of memory by not loading
irrelevant identity provider metadata.

Given CAS metadata can *only* include service providers, and presumably
all entries in a CAS xml file will include an SPSSODescriptor, I'm not
sure why that filter is included in the example. It was most likely
copied from an existing page that described SAML metadata and the filter
just wasn't removed from the example.

The reason it's stripping out all of your entries is that it is looking
specifically for "samlmd:SPSSODescriptor", and most likely your metadata
file doesn't match. Mine, for example, is:

<EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
	<EntityDescriptor entityID=XXX>
		<SPSSODescriptor

I would need to update the config to just match on "SSODescriptor" with
my metadata.

> Is there some additional configuration that is required when using the
> filter

Don't use the filter with CAS metadata, it's bad documentation. And if
you ever do have need of using the filter with SAML metadata, make sure
the config matches your XML file.

Hmm, I think I have update privs on the wiki; yup, filter removed from
example. Sorry for the confusion.