The Shibboleth IdP V4 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP5 wiki space for current documentation on the supported version.

InEntityGroupConfiguration

Owned by Scott Cantor
Last updated: Nov 15, 2021
1 min read

Namespace: urn:mace:shibboleth:2.0:afp
Schema: http://shibboleth.net/schema/idp/shibboleth-afp.xsd

Overview

The InEntityGroup type is a PolicyRule that returns true if the Name of any of the surrounding <EntitiesDescriptor> metadata of the requester matches the supplied parameter or whether the entity's metadata contains a matching <AffiliationDescriptor>.

Membership in a group is rarely an effective way of making policy decisions because hierarchies are inherently limiting and metadata sources tend not to align well to policy.

In general, base your attribute release policy on the characteristics of entity metadata only: SP entityID, entity attributes, and registration info. Avoid policy based on the characteristics of the aggregate itself. If you do rely on groups, prefer the <AffiliationDescriptor> mechanism which allows group membership to be separate from the entities themselves.

Reference

XML Attributes

Name

Type

Req?

Default

Description

Name

Type

Req?

Default

Description

groupID

String

Y

 

The <EntitiesDescriptor> Name to match against (or a matching <AffiliationDescriptor>)

checkAffiliations

Boolean

 

false

Whether to check metadata for <AffiliationDescriptor>-based matches

Example

Apply this rule if the entity for the SP is included in an <EntitiesDescriptor> or <AffiliationDescriptor> named urn:mace:example.org

<PolicyRequirementRule xsi:type="InEntityGroup" groupID="urn:mace:example.org" checkAffiliatons="true"/>

Â