How to Release Attributes on IDP from both - a Database and LDAP connectors

[Chad La Joie]

No, list both data connectors as dependencies for the email attribute
definition.

On Mon, Apr 30, 2012 at 09:11, Eugene Dvorkin
<Eugene.Dvorkin at artstor.org> wrote:
> Thank you Chad,
> Only one data source has data  per user. It is either in db or LDAP, but
> not in both.
> Are you talking about define Dependensies chapter in
> https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnector?
>
>
>
> On 04/30/2012 08:54 AM, Chad La Joie wrote:
>> You can't.  There is no conditional evaluation of connectors in v2.
>> That is a feature we implemented for v3, however.
>>
>> That said, depending on your data sources you might not need
>> conditional evaluation.  If only one data source has data (or if they
>> both have the same data) then you can just define both data
>> connectors, make them both a dependency of the email attribute
>> definition, and then just release that attribute as usual.
>>
>> If the two data sources have different email addresses for the same
>> person then it's not a Shib problem, your data sources are out of
>> synch and you need to address that issue fist.
>>
>> On Mon, Apr 30, 2012 at 08:49, Eugene Dvorkin
>> <Eugene.Dvorkin at artstor.org>  wrote:
>>> Hi,
>>> On IDP side, I have configured login.config file to perform search of the
>>> user credentials
>>> first in database and if not found then in LDAP. I want this setup so
>>> testing team can do automated tests again
>>> users in database and real people can use their credentials from LDAP. This
>>> is working fine for login.
>>> The problem is in attributeResolver:
>>>
>>> In attribute-resolver.xml I have 2 DataConnectors as well - database and
>>> LDAP. My attribute definition like this:
>>> <resolver:AttributeDefinition id="email" xsi:type="Simple"
>>> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>>>                                    sourceAttributeID="mail">
>>>          <resolver:Dependency ref="artstorDB" />
>>>
>>>   <resolver:AttributeDefinition id="myemail" xsi:type="Simple"
>>> xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>>>          sourceAttributeID="mail">
>>>          <resolver:Dependency ref="myLDAP" />
>>>
>>> Now, if I leave the same attribute id for both DataConnectors, I got error
>>> about duplicate attribute definition.
>>> If I change AttributeDefinition Id to something else, as above, then email
>>> attribute is not populated of course.
>>> 08:09:22.606 - DEBUG
>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:450]
>>> - Removing attribute email from resolution result for principal *****.  It
>>> contains no values.
>>>
>>>
>>> How can I chain attribute definitions so if no attribute extracted from
>>> database connector it get extracted from LDAP?
>>> I did not find answer in documentation so far.
>>> Thanks
>>>
>>>
>>>
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>
>>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered