<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi together,</p>
<p>we have a new requirement for our idp and i want to share my
experience and i also want to know if i did some mistake :-)<br>
</p>
<p>We have to skip the attribute release consent if the user tries
to login to a local sp that provides a privacyStatementURL in his
metadata.<br>
</p>
<p>At the moment we do not save the consent, the users have to
accept it after every login XD.<br>
Additionally we add an entityAttribute to all of our sp to mark
them local and remove this one from all external metadata to be
sure this attribute will not occure for any other sp.<br>
</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">MetadataProvider</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"LOCALMD"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">xsi:type</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"LocalDynamicMetadataProvider"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">sourceDirectory</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"%{idp.home}/metadata/local"</span><span style="color: #808080;">></span></div>
<div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">xsi:type</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"EntityAttributes"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">saml:Attribute</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">Name</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;"><a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">NameFormat</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"urn:oasis:names:tc:SAML:2.0:attrname-format:uri"</span><span style="color: #808080;">></span></div>
<div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">saml:AttributeValue</span><span style="color: #808080;">></span><span style="color: #d4d4d4;"><a class="moz-txt-link-freetext" href="https://tu-dresden.de/entity-type/local">https://tu-dresden.de/entity-type/local</a></span><span style="color: #808080;"></</span><span style="color: #569cd6;">saml:AttributeValue</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">saml:Attribute</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ConditionRef</span><span style="color: #808080;">></span><span style="color: #d4d4d4;">always-true</span><span style="color: #808080;"></</span><span style="color: #569cd6;">ConditionRef</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">MetadataProvider</span><span style="color: #808080;">></span></div></div>
</blockquote>
</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">MetadataProvider</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"DFN-AAI-SP"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">xsi:type</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"FileBackedHTTPMetadataProvider"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">backingFile</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"%{idp.home}/metadata/DFN-AAI-sp-metadata.xml"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">metadataURL</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;"><a class="moz-txt-link-rfc2396E" href="http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-sp-metadata.xml">"http://www.aai.dfn.de/fileadmin/metadata/dfn-aai-sp-metadata.xml"</a></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">maxRefreshDelay</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"PT2H"</span><span style="color: #808080;">></span></div>
<div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">xsi:type</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SignatureValidation"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">requireSignedRoot</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"true"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">certificateFile</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"/etc/apache2/ssl.crt/dfn-aai.g2.pem"</span><span style="color: #808080;">/></span></div>
<div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">xsi:type</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"RequiredValidUntil"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">maxValidityInterval</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"P14D"</span><span style="color: #808080;">/></span></div>
<div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">xsi:type</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"EntityRoleWhiteList"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">RetainedRole</span><span style="color: #808080;">></span><span style="color: #d4d4d4;">md:SPSSODescriptor</span><span style="color: #808080;"></</span><span style="color: #569cd6;">RetainedRole</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #808080;">>
</span></div><span style="color: #d4d4d4;"> </span><span style="color: #6a9955;"><!-- remove unauthorized entity attributes --></span><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">xsi:type</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"EntityAttributes"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">AttributeFilterScript</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">Script</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #ce9178;"><![CDATA[</span></div><div><span style="color: #ce9178;"> (function (attribute) {</span></div><div><span style="color: #ce9178;"> "use strict";</span></div><div><span style="color: #ce9178;"> var prefix = <a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a>;</span></div><div><span style="color: #ce9178;"> if (attribute === null) {</span></div><div><span style="color: #ce9178;"> return true;</span></div><div><span style="color: #ce9178;"> }</span></div><div><span style="color: #ce9178;"> return ! attribute.getName().startsWith(prefix);</span></div><div><span style="color: #ce9178;"> }(input));</span></div><div><span style="color: #ce9178;"> ]]></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">Script</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">AttributeFilterScript</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">MetadataFilter</span><span style="color: #808080;">></span></div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">MetadataProvider</span><span style="color: #808080;">></span></div>
</blockquote>
</p>
<p>To realize the new behaviour i firstly changed the relyingparty
config to use dynamic lookupStrategy [1] for the
postAuthenticationFlow:</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.DefaultRelyingParty"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"RelyingParty"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">property</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">name</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"profileConfigurations"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SAML2.SSO"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">p:postAuthenticationFlowsLookupStrategy-ref</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"postAuthenticationFlowsLookup"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">p:nameIDFormatPrecedenceLookupStrategy-ref</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"nameIDFormatPrecedenceLookup"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ref</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">bean</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SAML2.Logout"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SAML2.AttributeQuery"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">p:activationCondition-ref</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-consumes-persistentId"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ref</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">bean</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SAML2.ArtifactResolution"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">property</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div></div>
</blockquote>
</p>
<p>Within the corresponding lookup-bean, i used a
ScriptedPredicate[2] and a extra customObject-ref which combines
multiple other conditions like this:</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"postAuthenticationFlowsLookup"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.ContextFunctions.Scripted"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">factory-method</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"inlineScript"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">p:customObject-ref</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-skips-attribute-release"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">value</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #ce9178;"><![CDATA[</span></div><span style="color: #ce9178;"> if (custom.apply(input)) {</span><div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #ce9178;"> listType = Java.type("java.util.ArrayList");</span></div><div><span style="color: #ce9178;"> postAuthenticationFlows = new listType(1);</span></div><div><span style="color: #ce9178;"> postAuthenticationFlows.add("functional-user-check");</span></div><div><span style="color: #ce9178;"> } else {</span></div><div><span style="color: #ce9178;"> listType = Java.type("java.util.ArrayList");</span></div><div><span style="color: #ce9178;"> postAuthenticationFlows = new listType(2);</span></div><div><span style="color: #ce9178;"> postAuthenticationFlows.add("functional-user-check");</span></div><div><span style="color: #ce9178;"> postAuthenticationFlows.add("attribute-release");</span></div><div><span style="color: #ce9178;"> }</span></div></div><div><span style="color: #ce9178;"> postAuthenticationFlows;</span></div><div><span style="color: #ce9178;"> ]]></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">value</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div></div>
</blockquote>
</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-skips-attribute-release"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.Conditions.AND"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ref</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">bean</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-is-local"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">ref</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">bean</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-has-privacyURL"</span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div></div>
</blockquote>
</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-is-local"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.Conditions.EntityDescriptor"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">name</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"pred"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">class</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"org.opensaml.saml.common.profile.logic.EntityAttributesPredicate"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">class</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"org.opensaml.saml.common.profile.logic.EntityAttributesPredicate.Candidate"</span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">c:name</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;"><a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type">"https://tu-dresden.de/entity-type"</a></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">p:values</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;"><a class="moz-txt-link-rfc2396E" href="https://tu-dresden.de/entity-type/local">"https://tu-dresden.de/entity-type/local"</a></span><span style="color: #d4d4d4;"> </span><span style="color: #808080;">/></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">list</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div></div>
</blockquote>
</p>
<p>
<blockquote type="cite">
<div style="color: #d4d4d4;background-color: #1e1e1e;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">bean</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">id</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"SP-has-privacyURL"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">parent</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"shibboleth.Conditions.Scripted"</span><span style="color: #d4d4d4;"> </span><span style="color: #9cdcfe;">factory-method</span><span style="color: #d4d4d4;">=</span><span style="color: #ce9178;">"inlineScript"</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"><</span><span style="color: #569cd6;">value</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #ce9178;"><![CDATA[</span></div><span style="color: #ce9178;"> var result = false;</span><div><span style="color: #ce9178;"> var rpUIContextClass = "net.shibboleth.idp.ui.context.RelyingPartyUIContext";</span></div><div><span style="color: #ce9178;"> var authnContextClass = "net.shibboleth.idp.authn.context.AuthenticationContext";</span></div>
<div><span style="color: #ce9178;"> if (profileContext !== null) {</span></div><div><span style="color: #ce9178;"> var authnContext = profileContext.getSubcontext(authnContextClass);</span></div><div><span style="color: #ce9178;"> if (authnContext !== null) {</span></div><div><span style="color: #ce9178;"> var rpUIContext = authnContext.getSubcontext(rpUIContextClass);</span></div><div><span style="color: #ce9178;"> if (rpUIContext !== null) {</span></div><div><span style="color: #ce9178;"> privacyURL = rpUIContext.getPrivacyStatementURL();</span></div><div><span style="color: #ce9178;"> if( privacyURL !== null) {</span></div><div><span style="color: #ce9178;"> result = true;</span></div><div><span style="color: #ce9178;"> }</span></div><span style="color: #ce9178;"> }
</span><span style="color: #ce9178;"> }
</span><span style="color: #ce9178;"> }</span>
<span style="color: #ce9178;"></span><div><span style="color: #ce9178;"> result;</span></div><div><span style="color: #ce9178;"> ]]></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">value</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">constructor-arg</span><span style="color: #808080;">></span></div><div><span style="color: #d4d4d4;"> </span><span style="color: #808080;"></</span><span style="color: #569cd6;">bean</span><span style="color: #808080;">></span></div></div>
</blockquote>
</p>
<p>It took a while until i found the solution how to check for the
existence of a PrivacyStatementURL in the mdui:UIInfo extension of
the metadata by using the rpUIContext [3].<br>
The problem was to first get the AuthenticationContext and then
find out how the rpUIContextClass-string looks like.</p>
<p>But now it seems working and i ask me if it would be a good
example for how to retrieve informations from the mdui:UIInfo
extension.<br>
Where do you think is a good place in your documentation?</p>
<p>Please let me know what you think about this solution :-)<br>
Did i some mistakes or maybe there is a shorter and simpler
solution?</p>
<p>With nice regards.<br>
Martin<br>
</p>
<p>[1]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration#RelyingPartyConfiguration-OverridingDefaultSettingsDynamically3.3">https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration#RelyingPartyConfiguration-OverridingDefaultSettingsDynamically3.3</a><br>
[2]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedPredicate">https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedPredicate</a><br>
[3]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/RpUIContext">https://wiki.shibboleth.net/confluence/display/IDP30/RpUIContext</a><br>
</p>
<pre class="moz-signature" cols="72">--
Martin Lunze
IT-Systemadministrator
Technische Universität Dresden
Zentrum für Informationsdienste und Hochleistungsrechnen (ZIH)
Operative Prozesse und Systeme (OPS)
01062 Dresden
Tel.: +49 (351) 463-35881
E-Mail: <a class="moz-txt-link-abbreviated" href="mailto:martin.lunze@tu-dresden.de">martin.lunze@tu-dresden.de</a></pre>
</body>
</html>