<div dir="ltr"><div class="gmail_default" style="font-family:courier new,monospace">Thanks, it does appear to be documented but I didn't know what to look for. Thanks for pointing that out.<br><br>One thing I noticed, I think, is that metadata that already contains something like:<br> <mdattr:EntityAttributes xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><br> <saml:Attribute Name="urn:mace:ucsc.edu:metadata:attr:profile" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br><br></div><div class="gmail_default" style="font-family:courier new,monospace">and you then make a rule in the metadata filter like:<br> <MetadataFilter xsi:type="EntityAttributes"><br> <saml:Attribute Name="urn:mace:ucsc.edu:metadata:attr:profile"><br><br></div><div class="gmail_default" style="font-family:courier new,monospace">The filter will not augment existing AttributeValues in the metadata. Not really a problem in the real world but I noticed it while testing and wanted to point that out just in case someone ran into it thinking it wasn't working at all.<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><font face="courier new, monospace">Jeffrey<a href="mailto:jeffreyc@ucsc.edu" target="_blank"></a></font><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">Both pilots and IT professionals require training and currency before charging into clouds!<br></font></div><div><font face="courier new, monospace">---------------------------------------</font></div></div></div></div>
<br><div class="gmail_quote">On Fri, Jun 5, 2015 at 5:57 AM, Tom Scavo <span dir="ltr"><<a href="mailto:trscavo@gmail.com" target="_blank">trscavo@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Thu, Jun 4, 2015 at 8:30 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br>
> On 6/5/15, 12:22 AM, "Jeffrey Crawford" <<a href="mailto:jeffreyc@ucsc.edu">jeffreyc@ucsc.edu</a>> wrote:<br>
><br>
>>It sounds intriguing. Do you have an example of how it would be<br>
>>configured?<br>
><br>
> I can get something once I'm online for longer, I'm on vacation for a bit.<br>
> I think Tom Scavo actually asked me about this filter and might have an<br>
> example somewhere.<br>
<br>
</span>Yes, here it is:<br>
<br>
<!-- add an R&S entity attribute to one or more entity descriptors --><br>
<MetadataFilter type="EntityAttributes"><br>
<saml:Attribute<br>
Name="<a href="http://macedir.org/entity-category-support" target="_blank">http://macedir.org/entity-category-support</a>"<br>
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml:AttributeValue><a href="http://id.incommon.org/category/research-and-scholarship" target="_blank">http://id.incommon.org/category/research-and-scholarship</a></saml:AttributeValue><br>
</saml:Attribute><br>
<br>
<Entity><a href="https://identityprovider.anl.gov/idp/shibboleth" target="_blank">https://identityprovider.anl.gov/idp/shibboleth</a></Entity><br>
<!-- append as many IdP entityIDs as desired --><br>
</MetadataFilter><br>
<br>
If you include the above filter in your MetadataProvider, it will add<br>
the given entity attribute to every entity listed. The use case here<br>
is an R&S SP wanting to create a custom discovery interface consisting<br>
of all the R&S IdPs as well as a number of non-R&S IdPs. Here is a<br>
more complete example:<br>
<br>
<!-- add an R&S entity attribute to one or more entity descriptors --><br>
<MetadataFilter type="EntityAttributes"><br>
<saml:Attribute<br>
Name="<a href="http://macedir.org/entity-category-support" target="_blank">http://macedir.org/entity-category-support</a>"<br>
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml:AttributeValue><a href="http://id.incommon.org/category/research-and-scholarship" target="_blank">http://id.incommon.org/category/research-and-scholarship</a></saml:AttributeValue><br>
</saml:Attribute><br>
<br>
<Entity><a href="https://identityprovider.anl.gov/idp/shibboleth" target="_blank">https://identityprovider.anl.gov/idp/shibboleth</a></Entity><br>
<!-- append as many IdP entityIDs as desired --><br>
</MetadataFilter><br>
<br>
<!-- consume only InCommon metadata --><br>
<MetadataFilter type="Whitelist" matcher="EntityAttributes"><br>
<saml:Attribute<br>
Name="<a href="http://macedir.org/entity-category" target="_blank">http://macedir.org/entity-category</a>"<br>
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml:AttributeValue><a href="http://id.incommon.org/category/registered-by-incommon" target="_blank">http://id.incommon.org/category/registered-by-incommon</a></saml:AttributeValue><br>
</saml:Attribute><br>
</MetadataFilter><br>
<br>
<!-- expose all R&S IdPs registered by InCommon on the discovery<br>
interface --><br>
<DiscoveryFilter type="Whitelist" matcher="EntityAttributes"><br>
<saml:Attribute<br>
Name="<a href="http://macedir.org/entity-category-support" target="_blank">http://macedir.org/entity-category-support</a>"<br>
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml:AttributeValue><a href="http://id.incommon.org/category/research-and-scholarship" target="_blank">http://id.incommon.org/category/research-and-scholarship</a></saml:AttributeValue><br>
</saml:Attribute><br>
<saml:Attribute<br>
Name="<a href="http://macedir.org/entity-category-support" target="_blank">http://macedir.org/entity-category-support</a>"<br>
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml:AttributeValue><a href="http://refeds.org/category/research-and-scholarship" target="_blank">http://refeds.org/category/research-and-scholarship</a></saml:AttributeValue><br>
</saml:Attribute><br>
</DiscoveryFilter><br>
<br>
The above is for an SP. As an IdP operator, your goal should be to use<br>
only entity attributes (not entityIDs) to configure attribute release<br>
policy. If your IdP supports R&S, it already releases the R&S<br>
attribute bundle to R&S SPs based on an entity attribute. Does that<br>
bundle of attributes show up elsewhere in your attribute release<br>
policy? If so, you have a potential application of the above filter.<br>
<br>
More generally, review your attribute release policy to see if there<br>
are other sets of attributes used frequently. If so, define your own<br>
R&S-like category and use the above technique to collapse all those<br>
policy rules down to one.<br>
<span class="HOEnZb"><font color="#888888"><br>
Tom<br>
</font></span><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>