From 726d1805584c1c5e3b9e3f6008dd11c0abf5f704 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 31 Oct 2018 17:05:54 +0000
Subject: [PATCH] Permit blacklisting of InCommon-registered entities

See incommon/inc-meta#90.
---
 build.xml                               |  7 +++++
 mdx/incommon/beans.xml                  | 18 ++++++++++++
 mdx/incommon/import.xml                 |  8 ++++++
 mdx/incommon/incommon-blacklist.xml     | 37 +++++++++++++++++++++++++
 mdx/incommon/mdq-multisign-cloudhsm.xml |  3 ++
 mdx/incommon/mdq-multisign-localkey.xml |  3 ++
 6 files changed, 76 insertions(+)
 create mode 100644 mdx/incommon/incommon-blacklist.xml

diff --git a/build.xml b/build.xml
index 6c46c796..1c8348cf 100644
--- a/build.xml
+++ b/build.xml
@@ -2596,6 +2596,13 @@
     -->
     <property name="mda.inc.edugain.xml" value="${mda.incdir}/edugain.xml"/>
 
+    <!--
+        Default local file location from which to acquire the InCommon
+        entity blacklist.
+    -->
+    <property name="mda.inc.entity.blacklist"
+        value="classpath:incommon/incommon-blacklist.xml"/>
+
     <!--
         inc.fetch.production
 
diff --git a/mdx/incommon/beans.xml b/mdx/incommon/beans.xml
index e1843175..fe25a3ef 100644
--- a/mdx/incommon/beans.xml
+++ b/mdx/incommon/beans.xml
@@ -17,6 +17,14 @@
     -->
     <import resource="classpath:us_incommon/beans.xml"/>
 
+    <!--
+        Acquire the InCommon entity blacklist. This defaults to a
+        file contained within the repository, but can be overridden by
+        the mda.inc.entity.blacklist property (which shows up here
+        as inc.entity.blacklist).
+    -->
+    <import resource="${inc.entity.blacklist}"/>
+
     <!--
         finalise_parent
 
@@ -32,4 +40,14 @@
         </property>
     </bean>
 
+    <!--
+        remove_blacklisted_incommon_entities
+
+        Discard entities included in the InCommon entity blacklist.
+    -->
+    <bean id="remove_blacklisted_incommon_entities"
+        parent="mda.EntityFilterStage"
+        p:whitelistingEntities="false"
+        p:designatedEntities-ref="incommon_entity_blacklist"/>
+
 </beans>
diff --git a/mdx/incommon/import.xml b/mdx/incommon/import.xml
index 0eea7902..5c36fca7 100644
--- a/mdx/incommon/import.xml
+++ b/mdx/incommon/import.xml
@@ -265,6 +265,14 @@
                     </property>
                 </bean>
 
+                <!--
+                    Discard entities in the InCommon entity blacklist.
+
+                    Because this is done _after_ the eduGAIN merge, the
+                    named entities will be removed whatever their source.
+                -->
+                <ref bean="remove_blacklisted_incommon_entities"/>
+
                 <!-- Fork new pipelines to generate special aggregates. -->
                 <bean id="demux" parent="mda.PipelineDemultiplexerStage">
                     <property name="pipelineAndSelectionStrategies">
diff --git a/mdx/incommon/incommon-blacklist.xml b/mdx/incommon/incommon-blacklist.xml
new file mode 100644
index 00000000..7384aa2f
--- /dev/null
+++ b/mdx/incommon/incommon-blacklist.xml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+    <!--
+        *************************************************************
+        ***                                                       ***
+        ***   I N C O M M O N   E N T I T Y   B L A C K L I S T   ***
+        ***                                                       ***
+        *************************************************************
+    -->
+
+    <!--
+        The entities named in this set will be discarded from the
+        collection sourced from the InCommon Federation Manager.
+
+        The location of this file is defaulted to the version within
+        the repository, but may be overridden by setting the
+        mda.inc.entity.blacklist property.
+    -->
+    <util:set id="incommon_entity_blacklist">
+
+        <!-- Nothing in this example file. -->
+        <!--
+        <value>https://example.edu/entity</value>
+        -->
+
+    </util:set>
+
+</beans>
diff --git a/mdx/incommon/mdq-multisign-cloudhsm.xml b/mdx/incommon/mdq-multisign-cloudhsm.xml
index 2edaa4c9..0c166be9 100644
--- a/mdx/incommon/mdq-multisign-cloudhsm.xml
+++ b/mdx/incommon/mdq-multisign-cloudhsm.xml
@@ -57,6 +57,9 @@
                 <!-- Populate ItemId with the entityID. -->
                 <ref bean="populateItemIds"/>
 
+                <!-- Discard entities in the InCommon entity blacklist. -->
+                <ref bean="remove_blacklisted_incommon_entities"/>
+
                 <!-- Set ID, cacheDuration and validUntil attributes. -->
                 <bean parent="mda.GenerateIdStage"/>
                 <bean parent="mda.SetValidUntilStage" p:validityDuration="P14D"/>
diff --git a/mdx/incommon/mdq-multisign-localkey.xml b/mdx/incommon/mdq-multisign-localkey.xml
index 49bac301..e01a36ca 100644
--- a/mdx/incommon/mdq-multisign-localkey.xml
+++ b/mdx/incommon/mdq-multisign-localkey.xml
@@ -57,6 +57,9 @@
                 <!-- Populate ItemId with the entityID. -->
                 <ref bean="populateItemIds"/>
 
+                <!-- Discard entities in the InCommon entity blacklist. -->
+                <ref bean="remove_blacklisted_incommon_entities"/>
+
                 <!-- Set ID, cacheDuration and validUntil attributes. -->
                 <bean parent="mda.GenerateIdStage"/>
                 <bean parent="mda.SetValidUntilStage" p:validityDuration="P14D"/>