attribute-resolver.xml attribute with different data for each service ?!

[Chad La Joie]

Yes, but first I think your underlying assumption is wrong.  Normally a
persons entitlements wouldn't change just because of the service they
are accessing.  That is to say, I don't get a new entitlement just
because I logged in from service A.  Instead, what normally changes is
which of the user's entitlement values you want to send to a service.

So, *if* you really mean that a person is granted new entitlements based
on the service they are logging in from, then you'd want to use the
scripted attribute definition or write your own.

If, however, you mean the more normal case of only wanting to release
certain entitlements to certain services then you'd do that in the
attribute filter engine.  You'd create a policy for the service, then an
attribute value rule that only allows particular entitlements values to
be released.


On 12/26/11 9:46 AM, Rui Ramos wrote:
> Hello *,
> 
> I'm having some issues setting one attribute of type script in my IDP
> resolver config.
> 
> The main ideia was to have eduPersonEntitlement filled differently
> according to the service
> that initiated the auth request.
> 
>   Does the IDP suports this ? 
> 
> Best Regards,
> Rui Ramos
> 
> 
> -- 
> :: Rui Ramos ::
> Universidade do Porto - Reitoria
> Administração de Sistemas e Computação
> 
> T: +351 220408164
> E: rramos at reit.up.pt <mailto:rramos at reit.up.pt>
> 
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net