How to Release Attributes on IDP from both - a Database and LDAP connectors

[Chad La Joie]

You can't.  There is no conditional evaluation of connectors in v2.
That is a feature we implemented for v3, however.

That said, depending on your data sources you might not need
conditional evaluation.  If only one data source has data (or if they
both have the same data) then you can just define both data
connectors, make them both a dependency of the email attribute
definition, and then just release that attribute as usual.

If the two data sources have different email addresses for the same
person then it's not a Shib problem, your data sources are out of
synch and you need to address that issue fist.

On Mon, Apr 30, 2012 at 08:49, Eugene Dvorkin
<Eugene.Dvorkin at artstor.org> wrote:
> Hi,
> On IDP side, I have configured login.config file to perform search of the
> user credentials
> first in database and if not found then in LDAP. I want this setup so
> testing team can do automated tests again
> users in database and real people can use their credentials from LDAP. This
> is working fine for login.
> The problem is in attributeResolver:
>
> In attribute-resolver.xml I have 2 DataConnectors as well - database and
> LDAP. My attribute definition like this:
> <resolver:AttributeDefinition id="email" xsi:type="Simple"
> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>                                   sourceAttributeID="mail">
>         <resolver:Dependency ref="artstorDB" />
>
>  <resolver:AttributeDefinition id="myemail" xsi:type="Simple"
> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>         sourceAttributeID="mail">
>         <resolver:Dependency ref="myLDAP" />
>
> Now, if I leave the same attribute id for both DataConnectors, I got error
> about duplicate attribute definition.
> If I change AttributeDefinition Id to something else, as above, then email
> attribute is not populated of course.
> 08:09:22.606 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:450]
> - Removing attribute email from resolution result for principal *****.  It
> contains no values.
>
>
> How can I chain attribute definitions so if no attribute extracted from
> database connector it get extracted from LDAP?
> I did not find answer in documentation so far.
> Thanks
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered