EntityAttributeFilteringStage mishandles multiple containers
Basics
Technical
Logistics
Basics
Technical
Logistics
Description
Environment
None
Activity
Show:
Ian YoungOctober 19, 2016 at 3:27 PM
Do not close until 0.10.0
Ian YoungOctober 5, 2016 at 9:37 AMEdited
Commits cherry-picked onto master branch for 0.10.0.
Ian YoungOctober 5, 2016 at 8:42 AM
Done for 0.9.2, commits 30db186e5135a84eaaabe893db7ab17f32961406 and da4bde6b350f1ef91b813c495f7efe18885a1d88.
Ian YoungSeptember 7, 2016 at 5:17 PM
Example of problematic metadata:
<md:Extensions>
<mdrpi:RegistrationInfo registrationAuthority="http://www.surfconext.nl/" registrationInstant="2016-08-22T16:00:00Z">
<mdrpi:RegistrationPolicy xml:lang="en">https://wiki.surfnet.nl/display/eduGAIN/EduGAIN</mdrpi:RegistrationPolicy>
</mdrpi:RegistrationInfo>
<mdattr:EntityAttributes>
<saml:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
</saml:Attribute>
</mdattr:EntityAttributes>
<mdattr:EntityAttributes>
<saml:Attribute Name="http://macedir.org/entity-category" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xsi:type="xs:string">https://refeds.org/sirtfi</saml:AttributeValue>
</saml:Attribute>
</mdattr:EntityAttributes>
</md:Extensions>Fixed
Details
Assignee
Ian YoungIan YoungReporter
Ian YoungIan YoungComponents
Affects versions
Details
Details
Assignee
Ian Young
Ian YoungReporter
Ian Young
Ian YoungComponents
Affects versions
Created September 7, 2016 at 5:05 PM
Updated May 16, 2024 at 12:24 PM
Resolved October 5, 2016 at 9:37 AM
The MDATTR specification requires that an entity must have all its entity attributes in one
mdattr:EntityAttributesbasket. TheEntityAttributeFilteringStagerelies on this part of the specification by only filtering the first such container.This means that if there is more than one
mdattr:EntityAttributescontainer, the second and subsequent ones are ignored and left unfiltered. If one is relying on filtering to keep unwanted things out of one's metadata, this is undesirable.Having the stage throw a processing exception seems overly harsh in this case, and giving it the option of marking the
Itemwith anErrorStatuswould be a significant change to its contract. Combining all entity attributes into one container as a side-effect ofEntityAttributeFilteringStageseems likewise out of its scope.The best remaining approach appears to be to filter each such container independently.