/
EntityRoleFilter

The Shibboleth IdP V4 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP5 wiki space for current documentation on the supported version.

EntityRoleFilter

Owned by Scott Cantor
Last updated: Nov 15, 2021
2 min read

Namespace: urn:mace:shibboleth:2.0:metadata
Schema: http://shibboleth.net/schema/idp/shibboleth-metadata.xsd

Overview

The EntityRoleWhiteList filter removes unwanted role descriptors from entity metadata. Depending on the size and composition of the input, metadata filtered in this way may have a significantly reduced memory footprint.

The EntityRole filter removes unwanted role descriptors from entity metadata. Depending on the size and composition of the input, metadata filtered in this way may have a significantly reduced memory footprint.

For example, suppose an IdP loads (and reloads) metadata from a remote HTTP source using a FileBackedHTTPMetadataProvider. Since the IdP is focused on the <md:SPSSODescriptor> elements in the metadata aggregate, all other role descriptors may be removed. See below for an explicit example.

Filter order is important!

This filter changes the content of the metadata and so a filter of this type should appear after any SignatureValidationFilter in the overall sequence of filters.

Reference

Name

Type

Default

Description

Name

Type

Default

Description

removeRolelessEntityDescriptors

boolean

true

Controls whether to keep entity descriptors that contain no roles. Note: If false, the resulting output may not be schema-valid since an <md:EntityDescriptor> element must include at least one role descriptor child element.

removeEmptyEntitiesDescriptors

boolean

true

Controls whether to keep entities descriptors that contain no entity descriptors. Note: If false, the resulting output may not be schema-valid since an <md:EntitiesDescriptor> element must include at least one child element.

 

Affiliation descriptors are removed by default

An <md:EntityDescriptor> element that contains an <md:AffiliationDescriptor> child element is handled the same way as an <md:EntityDescriptor> element that contains no role descriptors. That is, if removeRolelessEntityDescriptors is true, both are filtered from the input.

Name

Cardinality

Description