<div dir="ltr"><div class="gmail_default" style="font-family:courier new,monospace">My goal is to use entity attributes to determine which attributes are released. For my locally managed metadata I<br></div><div class="gmail_default" style="font-family:courier new,monospace"> just add the EntityAttributes to our copy of the metadata.<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">For incommon I'm trying to use the metadata filter as described to "virtually" add these same attributes so they trigger the attribute filter rules based on the entityID's (This is only done to entities that don't request attributes) Each attribute value will trigger a particular filter rule. This all works just fine as long as my metadata filter looks like:<br><br> <MetadataFilter xsi:type="EntityAttributes"><br> <saml:Attribute Name="urn:mace:ucsc.edu:filter"><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-1</saml:AttributeValue><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-2</saml:AttributeValue><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-3</saml:AttributeValue><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-4</saml:AttributeValue><br> <Entity><a href="https://some.sp1.example.com/shibboleth">https://some.sp1.example.com/shibboleth</a></Entity><br> <Entity><a href="https://some.sp2.example.com/shibboleth">https://some.sp2.example.com/shibboleth</a></Entity><br> </MetadataFilter><br></div><div class="gmail_default" style="font-family:courier new,monospace"><br></div><div class="gmail_default" style="font-family:courier new,monospace">However the above forces me to make bundles or at worst an entry for each SP that needs special attributes (These are mostly UC apps in which we need to trade UC wide specific attributes)<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">What I want to do is have rules look like:<br> <MetadataFilter xsi:type="EntityAttributes"><br> <saml:Attribute Name="urn:mace:ucsc.edu:filter"><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-1</saml:AttributeValue><br> <Entity><a href="https://some.sp1.example.com/shibboleth">https://some.sp1.example.com/shibboleth</a></Entity><br> </MetadataFilter><br><br> <MetadataFilter xsi:type="EntityAttributes"><br> <saml:Attribute Name="urn:mace:ucsc.edu:filter"><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-2</saml:AttributeValue><br> <Entity><a href="https://some.sp1.example.com/shibboleth">https://some.sp1.example.com/shibboleth</a></Entity><br> <Entity><a href="https://some.sp2.example.com/shibboleth">https://some.sp2.example.com/shibboleth</a></Entity><br> </MetadataFilter><br><br> <MetadataFilter xsi:type="EntityAttributes"><br> <saml:Attribute Name="urn:mace:ucsc.edu:filter"><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-3</saml:AttributeValue><br> <Entity><a href="https://some.sp1.example.com/shibboleth">https://some.sp1.example.com/shibboleth</a></Entity><br> </MetadataFilter><br><br> <MetadataFilter xsi:type="EntityAttributes"><br> <saml:Attribute Name="urn:mace:ucsc.edu:filter"><br> <saml:AttributeValue>urn:mace:ucsc.edu:attr-4</saml:AttributeValue><br> <Entity><a href="https://some.sp1.example.com/shibboleth">https://some.sp1.example.com/shibboleth</a></Entity><br> <Entity><a href="https://some.sp2.example.com/shibboleth">https://some.sp2.example.com/shibboleth</a></Entity><br> </MetadataFilter><br><br></div><div class="gmail_default" style="font-family:courier new,monospace">That way sp1 would have attr-1 attr-2 attr-3 and attr-4 be released, where sp2 only gets attr-2 and attr-4. However it behaves as though only the first match wins, the others don't have attributes added that then match to attribute filters.<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">Just to be clear, the first example works beautifully and does what I'm telling it to but sp2 is getting attr-1 and attr-3 where it's not needed, or even unwanted. The latter example just needs me to add an entityID per variable that I want released.<br><br></div><div class="gmail_default" style="font-family:courier new,monospace">In short I'm trying to avoid having lots of custom attribute filters and rely more on metadata to determine what attributes are released.<br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature"><div dir="ltr"><font face="courier new, monospace">Jeffrey<a href="mailto:jeffreyc@ucsc.edu" target="_blank"><div class="gmail_default" style="font-family:courier new,monospace;display:inline"> <br></div></a></font><div><font face="courier new, monospace"><br></font></div><div><font face="courier new, monospace">Both pilots and IT professionals require training and currency before charging into clouds!<br></font></div><div><font face="courier new, monospace">---------------------------------------</font></div></div></div></div>
<br><div class="gmail_quote">On Mon, Jun 8, 2015 at 12:34 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 6/8/15, 3:31 PM, "users on behalf of Jeffrey Crawford" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:jeffreyc@ucsc.edu">jeffreyc@ucsc.edu</a>> wrote:<br>
<br>
>I've been testing using the IdP "consent" page observing the attributes before they are sent. I'll go ahead and file a bug<br>
<br>
</span>Do you mean you're attempting to configure a relying party override based on the tag?<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>