AttributeFilterScript

The <AttributeFilterScript> element contains a script (or a reference to a script) that implements Predicate<Attribute>. The boolean result of the script determines whether the parent <MetadataFilter> element acts on the input entity attribute. Specifically, if the predicate evaluates to false for a particular entity attribute in the input stream, the entity attribute is removed.

Schema

The <AttributeFilterScript> element is a configuration element of type ScriptType. Both the element and its type are defined by the urn:mace:shibboleth:2.0:metadata schema, which can be located at http://shibboleth.net/schema/idp/shibboleth-metadata.xsd.

The following sections describe the attributes and elements of the ScriptType type.

Examples

The following examples assume the default JavaScript language.

Typically the script operates on a single input parameter:

<ConditionScript>
    <Script>
    <![CDATA[
        // invoke a boolean function expression on a single parameter
        (function (attribute) {
            // function statements
        }(input));
    ]]>
    </Script>
</ConditionScript>

The actual input parameter is an instance of a class that implements the Attribute interface. The formal attribute parameter name is arbitrary.

If the customObjectRef attribute is present, the script operates on a pair of parameters called input and custom:

<ConditionScript customObjectRef="beanID">
    <Script>
    <![CDATA[
        // invoke a boolean function expression on two parameters
        (function (attribute, customObj) {
            // function statements
        }(input, custom));
    ]]>
    </Script>
</ConditionScript>

The actual custom parameter is an instance of an object class determined by the externally referenced bean. The corresponding formal parameter names are arbitrary.