The Shibboleth IdP V3 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP4 wiki space for current documentation on the supported version.

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 10 Next »

The EntityRoleWhiteList filter removes unwanted role descriptors from entity metadata. Depending on the size and composition of the input, metadata filtered in this way may have a significantly reduced memory footprint.

For example, suppose an IdP loads (and reloads) metadata from a remote HTTP source using a FileBackedHTTPMetadataProvider. Since the IdP is focused on the <md:SPSSODescriptor> elements in the metadata aggregate, all other role descriptors may be removed. See the Examples section for details.

Filter order is important!

This filter changes the content of the metadata and so a filter of type EntityRoleWhiteList should appear after any SignatureValidationFilter in the overall sequence of filters.

Namespace and Schema

The <MetadataFilter> element and the type EntityRoleWhiteList are defined by the urn:mace:shibboleth:2.0:metadata schema, which can be located at http://shibboleth.net/schema/idp/shibboleth-metadata.xsd.

Reference

Attributes

NameTypeDefaultDescription

removeRolelessEntityDescriptors

Booleantrue

Controls whether to keep entity descriptors that contain no roles

removeEmptyEntitiesDescriptors

BooleantrueControls whether to keep entities descriptors that contain no entity descriptors

Child Elements

NameCardinalityDescription

<RetainedRole>

0 or more

The textual content is the XML QName of the role to be retained.

Note that property replacement cannot be used on this element.

Examples

The following example retains all <md:SPSSODescriptor> elements in the input:

Retain SP roles only
<MetadataFilter xsi:type="EntityRoleWhiteList" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
    <RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>

If a particular entity descriptor contains no <md:SPSSODescriptor> child element, all role descriptors are removed. If the value of the removeRolelessEntityDescriptors attribute is true (which it is by default), the entity itself is removed as well.

Don't forget to configure a child element

If you forget to configure a <RetainedRole> child element, the filter will retain no roles; that is, an empty <MetadataFilter> element of type EntityRoleWhiteList will remove all roles (and therefore all entities) from the input. This is probably not what you want to do.
  • No labels