Predicate metadata filter applies an include or exclude rule to each entity in the input if a supplied Predicate<EntityDescriptor> returns true. The predicate may be defined explicitly (via the
conditionRef attribute) or implicitly from the child elements.
Filter order is important!
This filter changes the content of the metadata and so a filter of type
Predicate should appear after any SignatureValidationFilter in the overall sequence of filters.
<MetadataFilter> element and the type
Predicate are defined by the
urn:mace:shibboleth:2.0:metadata schema, which can be located at http://shibboleth.net/schema/idp/shibboleth-metadata.xsd.
|"include" or "exclude"|
This attribute must be set to either
If set to
If set to
If this attribute is not present, then the child elements are used to construct an implicit predicate as described below.
|boolean||This attribute is required if a |
|boolean||true||If the value of this attribute is true, then any |
conditionRef attribute is specified, then only it is used and any child elements are ignored. Otherwise the condition is constructed as one that returns true if:
entityIDof the candidate matches any of the supplied
Nameof any ancestor
<md:EntitiesDescriptor>element for the candidate matches any of the supplied
<Group>child elements OR
<mdattr:EntityAttributes>extension elements associated with the candidate match the supplied
<Tag>child elements OR
- Any scripts designated by a
<ConditionScript>element return true
|0 or more||The content of this element is an entity ID. If the content matches a candidate entity's |
|0 or more||The content of this element is the Name of an |
|0 or more|
The (required) attribute '
The content of this element is a series of one or more
|0 or more|
Don't forget to configure a child element
conditionRefis not present and you neglect to configure at least one child element, the filter will either exclude all entities (if
direction="include") or include all entities (if
direction="exclude"). In either case, this is probably not what you want to do.
Include a single entity
The following simple example includes at most one entity. This filter intentionally prevents new or unexpected entities from appearing in the metadata feed.
Exclude all entities containing a particular entity attribute
The next example excludes all entities containing a particular entity attribute, presumably because the IdP is the sole authority for this attribute.
Exclude all entities subject to a compound implicit condition
Note that implicit conditions may be combined in logical OR fashion. For instance, if any of the conditions in the following example are true, the entity is excluded:
"used in the above examples is a standard entity attribute name. For reference, consult the following specification: "The Entity Category SAML Attribute Types
Software version requirement
Include all entities based on a regexp applied to the entityID
The core of this is the
RegexPredicate. However this takes a string, rather than an EntityID and so we need to navigate to it. We could of course use jacascript, but the Spring EL Predicate provides a better shorthand. One injects the
RegexPredicate to do the work and use Spring EL to do the navigation. The result is this Spring Segment
Exclude "roleless" entity descriptors
Recall that the following
EntityRoleWhiteList filter retains all
<md:SPSSODescriptor> elements in the input:
The previous filter essentially filters all non-SP role descriptors from the input. At the end of that process, if an empty entity descriptor remains (because all of its roles have been removed), the entity itself is removed.
EntityRoleWhiteList filter may not handle affiliation descriptors as expected. Specifically, an
<md:EntityDescriptor> element that contains an
<md:AffiliationDescriptor> child element is handled in exactly the same way as an
<md:EntityDescriptor> element that contains no role descriptors. That is, if
removeRolelessEntityDescriptors is true (which it is by default), both are removed from the input.
A quick fix that preserves any affiliation descriptors in the input is to set
removeRolelessEntityDescriptors to false on the
EntityRoleWhiteList filter. However, this also prevents truly “roleless” entity descriptors from being removed, which may have a negative impact on memory utilization. A workaround is to use both an
EntityRoleWhiteList filter and a
Predicate filter, in sequence.
The following filter sequence is a complete replacement for the above
removeRolelessEntityDescriptors is set to false on the
EntityRoleWhiteList filter, which runs first. The
Predicate filter then removes the “roleless” entity descriptors from its input without disturbing the affiliation descriptors (if any).