How to Release Attributes on IDP from both - a Database and LDAP connectors

[Eugene Dvorkin]

Hi,
On IDP side, I have configured login.config file to perform search of the user credentials
first in database and if not found then in LDAP. I want this setup so testing team can do automated tests again
users in database and real people can use their credentials from LDAP. This is working fine for login.
The problem is in attributeResolver:

In attribute-resolver.xml I have 2 DataConnectors as well - database and LDAP. My attribute definition like this:
<resolver:AttributeDefinition id="email" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  sourceAttributeID="mail">
        <resolver:Dependency ref="artstorDB" />

 <resolver:AttributeDefinition id="myemail" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />

Now, if I leave the same attribute id for both DataConnectors, I got error about duplicate attribute definition.
If I change AttributeDefinition Id to something else, as above, then email attribute is not populated of course.
08:09:22.606 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:450] - Removing attribute email from resolution result for principal *****.  It contains no values.


How can I chain attribute definitions so if no attribute extracted from database connector it get extracted from LDAP?
I did not find answer in documentation so far.
Thanks




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120430/a9c2054c/attachment.html