<div dir="ltr">Thanks Scott!<div> I've gone for the group since we want to remove the filter only for a selected set of SPs whose metadata is collected in a file we manage ourselves</div><div> I've also tried to apply the "tag" way but didn't find a way to add the tag to all the SPs from out metadata, here the section so maybe you can give us a suggestion for the future:</div><div><br></div><div> thanks again!</div><div><br></div><div><div> <MetadataProvider id="PolimiMetadata"</div><div><span class="" style="white-space:pre"> </span>backingFile="%{idp.home}/metadata/localCopyFromInnerMeta.xml"</div><div><span class="" style="white-space:pre"> </span>metadataURL="<a href="https://outsite.it/ShibbolethMetadata/inner-metadata.jsp">https://outsite.it/ShibbolethMetadata/inner-metadata.jsp</a>" </div><div><span class="" style="white-space:pre"> </span>xsi:type="FileBackedHTTPMetadataProvider"</div><div><span class="" style="white-space:pre"> </span>minRefreshDelay="PT1M" <br></div><div><span class="" style="white-space:pre"> </span>maxRefreshDelay="PT4M" </div><div><span class="" style="white-space:pre"> </span>></div><div><br></div><div> <MetadataFilter xsi:type="EntityRoleWhiteList"></div><div> <RetainedRole>md:SPSSODescriptor</RetainedRole></div><div> </MetadataFilter></div><div><br></div><div><span class="" style="white-space:pre"> </span><!-- Simone --></div><div> <MetadataFilter xsi:type="EntityAttributes"><br></div><div><span class="" style="white-space:pre"> </span> <saml:Attribute Name="<a href="https://idp.polimi.it/internalSP">https://idp.polimi.it/internalSP</a>"></div><div><span class="" style="white-space:pre"> </span> <saml:AttributeValue>INTERNAL</saml:AttributeValue></div><div><span class="" style="white-space:pre"> </span> </saml:Attribute></div><div><span class="" style="white-space:pre"> </span> <Entity>*</Entity></div><div><span class="" style="white-space:pre"> </span></MetadataFilter></div><div><span class="" style="white-space:pre"> </span><!-- /Simone --> <br></div><div> </div><div> </MetadataProvider> </div></div><div><br></div><div><br></div><div> -Simone</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-10-28 18:48 GMT+01:00 Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 10/28/15, 1:39 PM, "users on behalf of Simone Avogadro" <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:simone.avogadro@gmail.com">simone.avogadro@gmail.com</a>> wrote:<br>
<br>
<br>
<br>
>Hi everyone,<br>
> at a quick glance I don't seem to find a way to enable attribute release consent only for some SPs.<br>
> Namely we have 2 different metadata provider:<br>
> - external: we want the attribute release to be shown<br>
> - internal: the user already gave us a broad consent and we don't want to show any more requests<br>
<br>
</span>You can't base it on metadata source directly. You can use EntitiesDescriptor Name as the basis of a group-based predicate or you can do something more general with EntityAttributes in the metadata, which is known as a tag-based predicate. That would require adding a MetadataFilter to the metadata providers that attaches a custom EntityAttribute to each entity when the metadata is loaded. Groups are much simpler, but much less general and highly dependent on control of the metadata sources.<br>
<br>
Either way, the most common places to apply the condition are in a RelyingParty override that enables or disables the specific intercept to run or by attaching it as an activationCondition to the intercept flow descriptor bean for the attribute consent flow. The descriptors are in intercept/profile-intercept.xml<br>
<span class=""><br>
> I guess this is a pretty common scenario but I missed the setting to configure this. Anyone so kind to provide some pointers to speedup the process?<br>
<br>
</span>There are examples on RelyingParty overrides and ActivationConditions in the wiki.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>