IDP Attribute Query

[Chad La Joie]

Right, I was just trying to say that you don't need to bend over
backwards to trying and get $requestContext.principalName to return what
you'd normally think of as the user's login ID.  That particular value
doesn't have any special meaning within the resolver.  Anywhere you use
it you can just as easily used a resolved attribute.

On 2/27/12 12:58 PM, Cantor, Scott wrote:
>> I'll note though that there is nothing special about the principal name
>> with in the resolver.  It happens to show up in logs but nothing within
>> the resolver really cares about it.  So there is no reason to prefer it
>> over something the resolver looks up based on it.  In fact, in IdPv3
>> there isn't even a special means of accessing it.  It's just an
>> attribute like any other.
> 
> True, but in the context of attribute queries, all you really have is the NameID in the query, so that has to be used as the starting point.
> 
> Using the plugin that identity-maps that into the principalName in V2 is a cleaner way to do it then writing a JDBC or LDAP plugin from scratch.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net