invoking data connector dynamically in attribute resolver

[Peter Schober]

* Robert A Basch <rbasch at mit.edu> [2012-05-18 23:49]:
> We have a use case here where we would like to invoke one or more
> additional data connectors (in addition to the one which pulls in
> our standard attributes	from our LDAP directory), but only for a small
> number of SPs, which account for a small percentage of our IdP
> transactions.

That's a very common desire/requirement. The IdP 3.x  will have
conditional data connectors, AFAIK.

> It looks like our options include: 1) write script code to perform the
> desired queries explicitly, i.e. not using a data connector at all, or 2)
> use the template language in the data connector to conditionally construct
> an effective "no-op" filter or query that would return no results (which
> could still use resources unnecessarily, though).
> 
> Is there another option?

Someone from our constituency used the method described in 
https://lists.internet2.edu/sympa/arc/shibboleth-users/2011-05/msg00433.html
You can define specific resolver and filter configs, set all
<DefaultRelyingParty> profile configuration attribute authorities to
their default value, and assign the newly created attribute
authorities to specific <RelyingParty>s.
Then whatever is in those resolvers will only be run for these
specific relying parties.
-peter