<div dir="ltr"><div class="gmail_default" style="font-family:courier new,monospace"><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><font face="courier new, monospace">Jeffrey<a href="mailto:jeffreyc@ucsc.edu" target="_blank"></a></font><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">Both pilots and IT professionals require training and currency before charging into clouds!<br></font></div><div><font face="courier new, monospace">---------------------------------------</font></div></div></div></div>
<br><div class="gmail_quote">On Mon, Jun 8, 2015 at 2:21 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="">On 6/8/15, 4:59 PM, "users on behalf of Jeffrey Crawford" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:jeffreyc@ucsc.edu">jeffreyc@ucsc.edu</a>> wrote:<br>
<br>
>I think the <MetadataFilter xsi:type="EntityAttributes"><br>
><br>
> may be broken<br>
<br>
</span>It's not broken. Trust me, it's not. You have this backwards. You're ascribing bugs in the code that is *consuming* what you're creating to the code that's creating it. The creation happens, the consuming code is not handling multiple copies of the Attribute. Some of the code does and some of it doesn't. The AttributeFilter code doesn't, which is the bug you're hitting.</blockquote><div class="gmail_default" style="font-family:courier new,monospace">Yes, you would know this better than me</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<span class=""><br>
>Correct attributes are added as long as the <Attribute Name="xxx" doesn't already exist<br>
<br>
</span>No. They are added regardless. There is no way for you to tell that though, because nothing would show it either way. You're observing a bug and then assuming the cause, but the cause is something else, that's all.<br>
<span class=""><br>
>The behaviour I'm not expecting is in the MetadataFilter EntityAttributes type functionality.<br>
<br>
</span>No, it's in the EntityAttribute-based AttributeFilter policy rules. That's where the bug is.<br>
<span class=""><br>
>The attribute filter is working fine as is the relying party.<br>
<br>
</span>No, it's not. The filter rule will work as long as the AttributeValues are all in one Attribute but not if they're separate. That doesn't mean the MetadataFilter isn't adding things, it means it's adding them in a way that triggers a bug later.<br>
<span class=""><br>
>Then the metadata filter doesn't work (I verify by knowing my attribute-filter.xml works via other means and using the consent page to see if I'm trying to release AttributeC), however if the metadata did not contain <saml:Attribute Name="some-name"<br>
>to begin with, then the metadata filter does add the attribute because I can see it being released in the consent page. I'm just using entity attributes to define which saml attributes I want to release.<br>
<br>
</span>You are incorrect about the attribute filter working. It does not work. That's the bug. If you want to observe that yourself, just forget the metadata filter for now, add the EntityAttribute extension content directly into a metadata file, but split the AttributeValues across two duplicate Attributes. That's the same thing the MetadataFilter is producing now, and it will trigger the same bug. Your rule acting on the second value won't fire.<br></blockquote><div> </div><div><div class="gmail_default" style="font-family:courier new,monospace">I'll leave you with this. This is what I've been doing with our locally managed metadata. This does work as I expect when setting up some basic attributes commonName, givenName, and surname<br>---------------------------------------------------<br></div><div class="gmail_default" style="font-family:courier new,monospace">attribute-filter.xml<br> <afp:AttributeFilterPolicy<br> id="commonName"><br><br> <afp:PolicyRequirementRule<br> xsi:type="saml:EntityAttributeExactMatch"<br> attributeName="urn:mace:ucsc.edu:metadata:attr:profile"<br> attributeValue="urn:mace:ucsc.edu:metadata:attr:profile:filter:common-name"/><br><br> <afp:AttributeRule<br> attributeID="commonName"><br> <afp:PermitValueRule<br> xsi:type="basic:ANY"/><br> </afp:AttributeRule><br> </afp:AttributeFilterPolicy><br><br> <afp:AttributeFilterPolicy<br> id="surname"><br><br> <afp:PolicyRequirementRule<br> xsi:type="saml:EntityAttributeExactMatch"<br> attributeName="urn:mace:ucsc.edu:metadata:attr:profile"<br> attributeValue="urn:mace:ucsc.edu:metadata:attr:profile:filter:surname"/><br><br> <afp:AttributeRule<br> attributeID="surname"><br> <afp:PermitValueRule<br> xsi:type="basic:ANY"/><br> </afp:AttributeRule><br> </afp:AttributeFilterPolicy><br><br> <afp:AttributeFilterPolicy<br> id="givenName"><br><br> <afp:PolicyRequirementRule<br> xsi:type="saml:EntityAttributeExactMatch"<br> attributeName="urn:mace:ucsc.edu:metadata:attr:profile"<br> attributeValue="urn:mace:ucsc.edu:metadata:attr:profile:filter:given-name"/><br><br> <afp:AttributeRule<br> attributeID="givenName"><br> <afp:PermitValueRule<br> xsi:type="basic:ANY"/><br> </afp:AttributeRule><br> </afp:AttributeFilterPolicy><br><br></div><div class="gmail_default" style="font-family:courier new,monospace">---------------------------------------------------------------------<br>local metadata:<br><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ID="_6adb70bdbbf7e14ab9d9231e70b7afa4cdd969d5" entityID="<a href="https://idm-test-sp.ucsc.edu/shibboleth">https://idm-test-sp.ucsc.edu/shibboleth</a>"><br>...<br> <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"<br> xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"<br> xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"><br>...<br> <mdrpi:RegistrationInfo registrationAuthority="<a href="http://ucsc.edu">http://ucsc.edu</a>"/><br> <mdattr:EntityAttributes xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><br> <saml:Attribute Name="urn:mace:ucsc.edu:metadata:attr:profile" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br> <saml:AttributeValue>urn:mace:ucsc.edu:metadata:attr:profile:filter:common-name</saml:AttributeValue><br> <saml:AttributeValue>urn:mace:ucsc.edu:metadata:attr:profile:filter:given-name</saml:AttributeValue><br> <saml:AttributeValue>urn:mace:ucsc.edu:metadata:attr:profile:filter:surname</saml:AttributeValue><br> </saml:Attribute><br> </mdattr:EntityAttributes><br> </md:Extensions><br>...<br></div><div class="gmail_default" style="font-family:courier new,monospace"></md:EntityDescriptor><br></div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class=""><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div></blockquote></div><br></div></div>