<div dir="ltr"><div class="gmail_default" style="font-family:courier new,monospace"><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><font face="courier new, monospace">Jeffrey <a href="mailto:jeffreyc@ucsc.edu" target="_blank"></a></font><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">Both pilots and IT professionals require training and currency before charging into clouds!<br></font></div><div><font face="courier new, monospace">---------------------------------------</font></div></div></div></div>
<br><div class="gmail_quote">On Mon, Jun 8, 2015 at 1:27 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="">On 6/8/15, 4:09 PM, "users on behalf of Jeffrey Crawford" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:jeffreyc@ucsc.edu">jeffreyc@ucsc.edu</a>> wrote:<br>
<br>
>My goal is to use entity attributes to determine which attributes are released. For my locally managed metadata I just add the EntityAttributes to our copy of the metadata.<br>
<br>
</span>Right, but what I need to know is *what* is broken.<br>
<br>
The filter is not broken that I can see. So what is? What is it that is supposed to be triggering on what you're adding that isn't triggering?<br></blockquote><div><div class="gmail_default" style="font-family:courier new,monospace;display:inline">I think the <MetadataFilter xsi:type="EntityAttributes"></div> <div class="gmail_default" style="font-family:courier new,monospace;display:inline"> may be broken</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
The consent engine does not care about EntityAttributes, so that statement made no sense to me unless what you meant is that you're trying to create a RelyingParty override to override a ProfileConfiguration bean to turn on the consent flow.<br></blockquote><div><div class="gmail_default" style="font-family:courier new,monospace;display:inline">correct I just meant that I was using the consent page to see if my rules are working correctly or not.</div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
>For incommon I'm trying to use the metadata filter as described to "virtually" add these same attributes so they trigger the attribute filter rules based on the entityID's (This is only done to entities that don't request attributes) Each attribute value will trigger a particular filter rule.<br>
<br>
</span>Ok, then that's not the consent engine at all, that's the filter engine. So maybe the EntityAttribute-based filter rule is broken.<br>
<span class=""><br>
>That way sp1 would have attr-1 attr-2 attr-3 and attr-4 be released, where sp2 only gets attr-2 and attr-4. However it behaves as though only the first match wins, the others don't have attributes<br>
> added that then match to attribute filters.<br>
<br>
</span>You have this backwards, that's what I'm telling you. The attributes *are* added. The bug is not there, it's at the other end.<br></blockquote><div><div class="gmail_default" style="font-family:courier new,monospace;display:inline">Correct attributes are added as long as the <Attribute Name="xxx" doesn't already exist<br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
I don't know how you would be able to conclude that the attributes are or are not added, other than by trying to use them. What I'm saying is, the bug is in what's using them, and so that requires that I know what's using them to pin down the location of the mistake.<br>
<br>
I actually looked at the RP override conditional logic and I'm actually fairly sure it does look at every Attribute it finds, not just the first one. So I would be interested to see if you can create such an override in relying-party.xml based on one of the tags that you don't think is being added. I think it will work</blockquote><div><div class="gmail_default" style="font-family:courier new,monospace;display:inline">The behaviour I'm not expecting is in the MetadataFilter EntityAttributes type functionality. The attribute filter is working fine as is the relying party. I'm obviously not explaining this well so I'm going to try and explain this another way. If the following exists in the metadata whether it's really in the metadata or added from a previous MetadataFilter EntityAtrributes rule:<br><br> <mdattr:EntityAttributes xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><br> <saml:Attribute Name="some-name" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml:AttributeValue>iWantAttributeA</saml:AttributeValue><br> <saml:AttributeValue>iWantAttributeB</saml:AttributeValue><br> </saml:Attribute><br> </mdattr:EntityAttributes><br><br></div><div class="gmail_default" style="font-family:courier new,monospace;display:inline">and I add the following to the metadata-providers.xml<br><br> <MetadataFilter xsi:type="EntityAttributes"><br> <saml:Attribute Name="some-name"><br> <saml:AttributeValue>iWantAttributeC</saml:AttributeValue><br> </saml:Attribute><br> <Entity><a href="https://somesp.example.edu/shibboleth">https://somesp.example.edu/shibboleth</a></Entity><br> </MetadataFilter><br><br></div><div class="gmail_default" style="font-family:courier new,monospace;display:inline">Then the metadata filter doesn't work (I verify by knowing my attribute-filter.xml works via other means and using the consent page to see if I'm trying to release AttributeC), however if the metadata did not contain <saml:Attribute Name="some-name"</div><div class="gmail_default" style="font-family:courier new,monospace;display:inline"></div> <div class="gmail_default" style="font-family:courier new,monospace;display:inline">to begin with, then the metadata filter does add the attribute because I can see it being released in the consent page. I'm just using entity attributes to define which saml attributes I want to release.<br><br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
I have not looked at the filter plugin yet.<br>
<div class=""><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>