IDP Attribute Query

[James Drews]

On 2/27/2012 8:53 AM, Francesco Malvezzi wrote:
> Is it not enought to ride the
>    <resolver:PrincipalConnector xsi:type="Direct"
> xmlns="urn:mace:shibboleth:2.0:resolver:pc" id="direct"
>
> nameIDFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" />
> which you maybe are not using elsewhere?
> (i.e. changing definition from Transient to Direct)
>
> So the attribute from the SP arrives to the IdP as a principal and you
> can build a (database)DataConnector with a filterTemplate like:
> <![CDATA[
> #if (requestContext.getProfileConfiguration().getProfileId() !=
> "urn:mace:shibboleth:2.0:profiles:saml2:query:attribute")
>                          SELECT FROM TABLE WHERE
> UID=$requestContext.principalName
> #else
>                          SELECT FROM TABLE2 WHERE
> OTHER_UID=$requestContext.principalName
> #end
> ]]>
>
> I hope it is not so ugly, because I was planning to do so (the only
> difference is ldap instead of relational database)
>
> regards,
>
> Francesco
>

Ok, so going down this line, is there then a way to asssign 
$requestContext.principalName
to be the naming attribute of the second IDP so all the other attributes 
lookup correctly?



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 9405 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20120227/112c9c9e/attachment.bin