{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Namespace:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}},{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"urn:mace:shibboleth:2.0:metadata","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"Schema:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}},{"type":"strong"}]},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"http://shibboleth.net/schema/idp/shibboleth-metadata.xsd","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}},{"type":"link","attrs":{"href":"http://shibboleth.net/schema/idp/shibboleth-metadata.xsd"}}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"046031fc-d973-41ee-acad-115216110476"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"a31ea129-505a-4bb2-ba7d-4c61b59d0d48"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"A filter of type ","type":"text"},{"text":"EntityAttributes","type":"text","marks":[{"type":"code"}]},{"text":" adds or removes SAML entity attributes to or from metadata in order to drive software behavior. This filter is usually applied to an HTTP metadata provider such as the ","type":"text"},{"text":"FileBackedHTTPMetadataProvider","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506865"}}]},{"text":" or the ","type":"text"},{"text":"DynamicHTTPMetadataProvider","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506816"}}]},{"text":", since locally maintained metadata is directly modifiable already.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension element is a container for entity attributes, sometimes referred to informally as \"tags\". \"Tagging\" an entity refers to attaching an entity attribute.","type":"text"}]},{"type":"paragraph","content":[{"text":"Syntactically, an entity attribute looks like an ordinary user attribute one might find in an assertion. For example:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"A simple entity attribute","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n http://refeds.org/category/research-and-scholarship\n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"In the previous example, the name and value of the entity attribute are ","type":"text"},{"text":"http://macedir.org/entity-category","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"http://refeds.org/category/research-and-scholarship","type":"text","marks":[{"type":"code"}]},{"text":", respectively. Note that an entity attribute may be multi-valued.","type":"text"}]},{"type":"paragraph","content":[{"text":"To use the ","type":"text"},{"text":"EntityAttributes","type":"text","marks":[{"type":"code"}]},{"text":" filter, sequences of ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements are supplied as filter content. When a child element such as ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" evaluates to true, the SAML attributes are applied to the corresponding entities as entity attributes. The software automatically adds or removes the parent ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension element as needed.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Filter order is important!","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"This filter changes the content of the metadata and so a filter of type ","type":"text"},{"text":"EntityAttributes","type":"text","marks":[{"type":"code"}]},{"text":" should appear after any ","type":"text"},{"text":"SignatureValidationFilter","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507384"}}]},{"text":" in the overall sequence of filters.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"success"},"content":[{"type":"paragraph","content":[{"text":"Position the EntityAttributes filter for efficiency","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Deliberately position an ","type":"text"},{"text":"EntityAttributes","type":"text","marks":[{"type":"code"}]},{"text":" filter in the overall sequence of filters for optimal efficiency. In particular, a filter of type ","type":"text"},{"text":"EntityAttributes","type":"text","marks":[{"type":"code"}]},{"text":" should appear after the ","type":"text"},{"text":"EntityRoleFilter","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507218"}}]},{"text":" since the latter effectively removes entities from the input.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"An inbound attribute filtering feature (","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":") allows pre-existing entity attributes to be removed prior to performing any additions. This allows locally applied tags to be blocked from use by external metadata sources, which prevents misuse.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Other Relevant Schemas","type":"text"}]},{"type":"paragraph","content":[{"text":"Unlike many features, configuring this filter typically requires supplying elements from other XML namespaces, so requires some working knowledge of editing XML and mixing namespaces.","type":"text"}]},{"type":"paragraph","content":[{"text":"The schema for the ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" extension element that is produced by this filter is part of the OASIS ","type":"text"},{"text":"SAML V2.0 Metadata Extension for Entity Attributes","type":"text","marks":[{"type":"link","attrs":{"href":"https://wiki.oasis-open.org/security/SAML2MetadataAttr"}}]},{"text":" specification, though this isn't typically directly needed when configuring this filter.","type":"text"}]},{"type":"paragraph","content":[{"text":"The embedded entity attributes produced by the filter are defined by the ","type":"text"},{"text":"urn:oasis:names:tc:SAML:2.0:assertion","type":"text","marks":[{"type":"code"}]},{"text":" namespace, the schema for which can be located at ","type":"text"},{"text":"http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd"}}]},{"text":". The latter namespace is usually associated with the ","type":"text"},{"text":"saml:","type":"text","marks":[{"type":"code"}]},{"text":" prefix.","type":"text"}]},{"type":"paragraph","content":[{"text":"SAML Attribute elements typically must be embedded in the configuration of the filter. The examples in this topic illustrate the most advisable approach.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"XML Elements","type":"text"}]},{"type":"paragraph","content":[{"text":"The first two are optional, mutually exclusive, and must appear first:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"table","attrs":{"layout":"full-width","width":1215.0,"localId":"ca5cbe02-9a25-4fe5-8823-0e005788a068"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[205.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[205.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"Optional Bean ID of type ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"Attribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.saml.saml2.core.Attribute"}}]},{"text":">, this is applied to all pre-existing extension attributes and any for which it evaluates ","type":"text"},{"text":"false","type":"text","marks":[{"type":"strong"}]},{"text":" are removed prior to subsequent additions","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[205.0]},"content":[{"type":"paragraph","content":[{"text":"<","type":"text"},{"text":"AttributeFilterScript","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507192"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1010.0]},"content":[{"type":"paragraph","content":[{"text":"The content of this element is an inline or local script resource that implements ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"Attribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.saml.saml2.core.Attribute"}}]},{"text":">, which is applied to all pre-existing extension attributes. Any entity attribute for which it evaluates ","type":"text"},{"text":"false","type":"text","marks":[{"type":"strong"}]},{"text":" are removed prior to subsequent additions.","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Then, a","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"ny of the following can be supplied in any order:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","width":1217.0,"localId":"8325d3c3-a8db-453f-a583-8f854d4501b3"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"text":"Name","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[1034.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"},{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1034.0]},"content":[{"type":"paragraph","content":[{"text":"An attribute which is added to all the entities which match any of the following ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" or ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" elements","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1034.0]},"content":[{"type":"paragraph","content":[{"text":"The textual content is an entityID. All preceding attributes are added to the matching entity.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"text":" ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1034.0]},"content":[{"type":"paragraph","content":[{"text":"The textual content is a regular expression to match against the entityID. All preceding attributes are added to matching entities.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"text":"","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1034.0]},"content":[{"type":"paragraph","content":[{"text":"The textual content is the Bean ID of type ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"EntityDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.saml.saml2.metadata.EntityDescriptor"}}]},{"text":">. All preceding attributes are added to the entities for which this returns true.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[183.0]},"content":[{"type":"paragraph","content":[{"text":"<","type":"text"},{"text":"ConditionScript","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199507115"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1034.0]},"content":[{"type":"paragraph","content":[{"text":"The content of this element is an inline or local script resource that implements ","type":"text"},{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate"}}]},{"text":"<","type":"text"},{"text":"EntityDescriptor","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.saml.saml2.metadata.EntityDescriptor"}}]},{"text":">. All preceding attributes are added to the entities for which this returns true.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Examples","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Add entity attributes to metadata","type":"text"}]},{"type":"paragraph","content":[{"text":"The following example adds the entity attribute ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"\"https://sp.example.org/tagname1\"","type":"text"},{"text":" to entity ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"\"https://sp1.example.org\", and both \"https://sp.example.org/tagname1\" and \"https://sp.example.org/tagname2","type":"text"},{"text":"\" to entity ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#222222"}}]},{"text":"\"https://sp2.example.org\"","type":"text"}]},{"type":"expand","attrs":{"title":"Add entity attributes to metadata"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n foo\n \n https://sp1.example.org\n \n foo\n bar\n \n https://sp2.example.org\n","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Remove entity attributes from metadata","type":"text"}]},{"type":"paragraph","content":[{"text":"The following example removes unauthorized entity attributes from our reserved namespace from the input.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":" T","type":"text"},{"text":"he metadata filter uses an ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" to remove any and all entity attributes that might be used to subsequently configure a SAML protocol (or impact other behavior) at runtime. It does this by matching on a common prefix.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"paragraph","content":[{"text":"Note that you may have other tag names in use from namespaces of your own choosing and this example won’t protect against injection of those tags, so use the example as a starting point, not a solution.","type":"text"}]},{"type":"expand","attrs":{"title":"Remove unauthorized entity attributes from metadata"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n \n \n \n \n\n","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Protect your metadata-driven configuration ","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"An IdP that configures itself on-the-fly using entity attributes should include the previous filter in the overall sequence of filters. The previous filter should appear before any entity attributes are added by subsequent filters. On the other hand, i","type":"text"},{"text":"f the metadata source is completely trustworthy (e.g., a local metadata source), the previous filter is not necessary. See the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"MetadataDrivenConfiguration","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508127"}}]},{"text":" topic for more info.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Add entity attributes that affect signing operations","type":"text"}]},{"type":"paragraph","content":[{"text":"The following example uses entity attributes to ","type":"text"},{"text":"override default signing operations","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508127#MetadataDrivenConfiguration-signAssertions"}}]},{"text":" during web browser SSO.","type":"text"}]},{"type":"expand","attrs":{"title":"Add entity attributes that affect signing operations"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n \n \n true\n \n \n \n https://sp.example1.org\n \n \n \n false\n \n \n \n https://sp.example2.org\n https://sp.example3.org\n\n","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Add an entity attribute that disables encryption","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"paragraph","content":[{"text":"The following example uses an entity attribute to ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"disable encryption","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}},{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199508127#MetadataDrivenConfiguration-encryptAssertions"}}]},{"text":" on a specific set of entities in the input.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":" A","type":"text"},{"text":" ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" adds the entity attribute (","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"encryptAssertions","type":"text","marks":[{"type":"code"}]},{"text":") to a collection of entities specified by a Spring bean (","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"customObjectRef=\"MyEntityCollection\"","type":"text","marks":[{"type":"code"}]},{"text":") defined elsewhere in the configuration. The collection is exposed to the script via a ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"custom","type":"text","marks":[{"type":"code"}]},{"text":" object of type ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"Collection","type":"text","marks":[{"type":"code"}]},{"text":". Each element of the collection is an ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"entityID","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"paragraph","content":[{"text":"The script takes an argument of type ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"Collection","type":"text","marks":[{"type":"code"}]},{"text":" (i.e., the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"custom","type":"text","marks":[{"type":"code"}]},{"text":" object) and returns a function that implements ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"Predicate","type":"text","marks":[{"type":"code"}]},{"text":". The resulting predicate is applied to the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]},{"text":"input","type":"text","marks":[{"type":"code"}]},{"text":" object. The entity attribute is added to the entity descriptor if (and only if) the predicate evaluates to true.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#000000"}}]}]},{"type":"expand","attrs":{"title":"Add an entity attribute that disables encryption"},"content":[{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n\n\n \n \n false\n \n\n \n \n \n \n","type":"text"}]}]},{"type":"paragraph"}],"version":1}