How to Release Attributes on IDP from both - a Database and LDAP connectors

[Eugene Dvorkin]

Thank you Chad,
Only one data source has data  per user. It is either in db or LDAP, but 
not in both.
Are you talking about define Dependensies chapter in
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnector?



On 04/30/2012 08:54 AM, Chad La Joie wrote:
> You can't.  There is no conditional evaluation of connectors in v2.
> That is a feature we implemented for v3, however.
>
> That said, depending on your data sources you might not need
> conditional evaluation.  If only one data source has data (or if they
> both have the same data) then you can just define both data
> connectors, make them both a dependency of the email attribute
> definition, and then just release that attribute as usual.
>
> If the two data sources have different email addresses for the same
> person then it's not a Shib problem, your data sources are out of
> synch and you need to address that issue fist.
>
> On Mon, Apr 30, 2012 at 08:49, Eugene Dvorkin
> <Eugene.Dvorkin at artstor.org>  wrote:
>> Hi,
>> On IDP side, I have configured login.config file to perform search of the
>> user credentials
>> first in database and if not found then in LDAP. I want this setup so
>> testing team can do automated tests again
>> users in database and real people can use their credentials from LDAP. This
>> is working fine for login.
>> The problem is in attributeResolver:
>>
>> In attribute-resolver.xml I have 2 DataConnectors as well - database and
>> LDAP. My attribute definition like this:
>> <resolver:AttributeDefinition id="email" xsi:type="Simple"
>> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>>                                    sourceAttributeID="mail">
>>          <resolver:Dependency ref="artstorDB" />
>>
>>   <resolver:AttributeDefinition id="myemail" xsi:type="Simple"
>> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>>          sourceAttributeID="mail">
>>          <resolver:Dependency ref="myLDAP" />
>>
>> Now, if I leave the same attribute id for both DataConnectors, I got error
>> about duplicate attribute definition.
>> If I change AttributeDefinition Id to something else, as above, then email
>> attribute is not populated of course.
>> 08:09:22.606 - DEBUG
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:450]
>> - Removing attribute email from resolution result for principal *****.  It
>> contains no values.
>>
>>
>> How can I chain attribute definitions so if no attribute extracted from
>> database connector it get extracted from LDAP?
>> I did not find answer in documentation so far.
>> Thanks
>>
>>
>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>