Building a composite attribute from sets of attributes

[Cantor, Scott]

On 8/6/19, 10:57 AM, "dev on behalf of Etienne Dysli Metref" <dev-bounces at shibboleth.net on behalf of etienne.dysli-metref at switch.ch> wrote:

> There is, however, one case where this falls short: when a university
> issues separate accounts for a person that is both student and staff.

I hate few things as much as I hate that practice.

> Here attributes from both accounts come from the same IdP so their
> association with the staff or student role is lost. For example,
> eduPersonUniqueId or email values from the student account and the staff
> account would be mixed together. We would like to find a solution that
> keeps these separate.

I'm not sure I would argue that those attributes should really be mixed; the whole point of that dual account strategy is to segregate access and not lump the information together in one session. Nothing you want to notice that distinction will notice it and you're right back where you started.

> Do you have time for a call to discuss this? I'm not sure I managed to
> correctly explain what we are doing and want to achieve in writing.

I think I get it, but if you want time on a dev call to talk about it, that's fine (next one is Aug 16th, 10-12 EDT).

Either way, if you really want JSON, just deal with it as a string value. Build a scripted attribute that pulls in everything else and cooks up the JSON you want to pass out as a single string value.
 
-- Scott