<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi List,</p>
our identity provider (idp) is member of the DFN-AAI (german
federation) and we have some functional accounts in our idm.<br>
<br>
As it is not allowed to use them outside our organisation i included
some custom login flow / context check interceptor to prevent these
accounts to authenticate for external service providers (sp).<br>
<br>
I did this by checking the registration authority information of the
metadata.<br>
If the sp is registered by the DFN-AAI than the login-flow stops at
idp side.<br>
<br>
Here is the relevant bean i use:<br>
<br>
<blockquote type="cite"><bean <span class="sc3"><span
class="re0">id</span>=<span class="st0">"SP-is-in-DFNAAI"</span>
<span class="re0">parent</span>=<span class="st0">"shibboleth.Conditions.EntityDescriptor"</span><span
class="re2">><br>
</span></span><span class="sc3"><span class="re1">
<constructor-arg</span> <span class="re0">name</span>=<span
class="st0">"pred"</span><span class="re2">></span></span><span
class="sc3"><span class="re2"><br>
</span></span><span class="sc3"><span class="re1"><bean</span>
<span class="re0">class</span>=<span class="st0">"org.opensaml.saml.common.profile.logic.RegistrationAuthorityPredicate"</span></span>
<span class="sc3"><span class="re2"></span></span><br>
<span class="sc3"><span class="re1"><constructor-arg<span
class="re2">><br>
</span></span></span><span class="sc3"><span
class="re1"><list<span class="re2">><br>
</span></span></span><span class="sc3"><span
class="re1"><value<span class="re2">></span></span></span><a class="moz-txt-link-freetext" href="https://www.aai.dfn.de">https://www.aai.dfn.de</a><span
class="sc3"><span class="re1"></value<span class="re2">><br>
</list><br>
</span></span></span><span class="sc3"><span
class="re1"></constructor-arg<span class="re2">><br>
</span></span></span><span class="sc3"><span
class="re1"></bean><br>
</span></span><span class="sc3"><span class="re1"></constructor-arg><br>
</bean></span></span><br>
<span class="sc3"><span class="re1"><span class="re2"></span></span></span></blockquote>
<br>
These works great.<br>
But now our idp is joining EduGain and i am looking for a mechanism
to simply and flexible check if the sp (the user wants to login) is
in edugain or not.<br>
I did not want to extend the list of registration authorities and i
did not want to "mark" our local sp and using "InEntityGroup" is
also no possibility.<br>
<br>
After some reading and testing i think i found the "best" solution
for me.<br>
Using EntityAttributes-MetadataFilter [1] like this to create a
"flag" (entityAttribute) for every member [2] of the EduGain
metadata:<br>
<br>
<blockquote type="cite"><MetadataProvider id="DFN-AAI-EduGain"<br>
xsi:type="FileBackedHTTPMetadataProvider"<br>
backingFile="%{idp.home}/metadata/DFN-AAI-edugain-metadata.xml"<br>
metadataURL=<a class="moz-txt-link-rfc2396E" href="https://www.aai.dfn.de/fileadmin/metadata/dfn-aai-edugain+sp-metadata.xml">"https://www.aai.dfn.de/fileadmin/metadata/dfn-aai-edugain+sp-metadata.xml"</a><br>
maxRefreshDelay="PT2H"><br>
<br>
<MetadataFilter xsi:type="SignatureValidation"
requireSignedRoot="true"<br>
certificateFile="/etc/apache2/ssl.crt/dfn-aai.g2.pem"/><br>
<MetadataFilter xsi:type="EntityRoleWhiteList"><br>
<RetainedRole>md:SPSSODescriptor</RetainedRole><br>
</MetadataFilter><br>
<MetadataFilter xsi:type="EntityAttributes"><br>
<saml:Attribute<br>
Name=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a><br>
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml:AttributeValue><a class="moz-txt-link-freetext" href="https://tu-dresden.de/entity-type/external/edugain">https://tu-dresden.de/entity-type/external/edugain</a></saml:AttributeValue><br>
</saml:Attribute><br>
<ConditionRef>always-true</ConditionRef><br>
</MetadataFilter><br>
</MetadataProvider><br>
<br>
<bean id="always-true" factory-method="alwaysTrue"
class="com.google.common.base.Predicates"/><br>
</blockquote>
[1]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/EntityAttributesFilter">https://wiki.shibboleth.net/confluence/display/IDP30/EntityAttributesFilter</a><br>
[2]
<a class="moz-txt-link-freetext" href="http://shibboleth.1660669.n2.nabble.com/idpv3-attribute-resolver-PluginActivationConditions-td7618529.html">http://shibboleth.1660669.n2.nabble.com/idpv3-attribute-resolver-PluginActivationConditions-td7618529.html</a><br>
<br>
At this moment i had the idea to not only create one value for the
new entityAttribute, but rather multiple values for different
federations or "groups" of sp.<br>
<br>
My activation condition to check for "external" sp (tagged relying
parties [3]) now looks like this:<br>
<br>
<blockquote type="cite"><bean id="SP-is-external"
parent="shibboleth.Conditions.EntityDescriptor"><br>
<constructor-arg name="pred"><br>
<bean
class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate"><br>
<constructor-arg><br>
<list><br>
<bean
class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"<br>
c:name=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a><br>
p:values=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type/external">"https://tu-dresden.de/entity-type/external"</a> /><br>
<bean
class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"<br>
c:name=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a><br>
p:values=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type/external/dfn-aai">"https://tu-dresden.de/entity-type/external/dfn-aai"</a>
/><br>
<bean
class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"<br>
c:name=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a><br>
p:values=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type/external/dfn-aai/sp">"https://tu-dresden.de/entity-type/external/dfn-aai/sp"</a>
/><br>
<bean
class="org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"<br>
c:name=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a><br>
p:values=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type/external/edugain">"https://tu-dresden.de/entity-type/external/edugain"</a>
/><br>
</list><br>
</constructor-arg><br>
</bean><br>
</constructor-arg><br>
</bean></blockquote>
[3]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-RelyingPartiesByTag">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-RelyingPartiesByTag</a><br>
<br>
Among other questions came up i now want to know if it is possible
to use regex for this task?<br>
Filtering attributes supports such a mechanism [4], but i did not
found a solution to build a analogue bean / activation condition.<br>
<br>
<blockquote type="cite"><Rule
xsi:type="EntityAttributeRegexMatch"<br>
attributeName=<a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a><br>
attributeValueRegex="^<a class="moz-txt-link-freetext" href="https://tu-dresden.de/entity-type/external.*$">https://tu-dresden.de/entity-type/external.*$</a>"
/></blockquote>
[4]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/EntityAttributeRegexMatchConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/EntityAttributeRegexMatchConfiguration</a><br>
<br>
Maybe i missed some interesting point of the documentation?<br>
Or other solutions for my purpose?<br>
<br>
With nice regards.<br>
Martin<br>
<pre class="moz-signature" cols="72">--
Martin Lunze
IT-Systemadministrator
Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden
Tel.: +49 (351) 463-35881
E-Mail: <a class="moz-txt-link-abbreviated" href="mailto:martin.lunze@tu-dresden.de">martin.lunze@tu-dresden.de</a></pre>
</body>
</html>