Attribute Queries: Needed set up?

[Erdos, Marlena]

Hi,

I'd like to do an "off-line" attribute query on a user.  That is, with
some user info that could count as a NameID (say email address), have my
app pull attributes about the user without the user having tried to
contact my app.  (I'm fairly well-versed in privacy so please trust that
that is not an issue in my circumstance.)

I haven't been able to figure out how to do this.

I know I need to provide a NameID in the attribute query.  And I know I
need to set up my relying-party info to allow for attribute queries.  But
what I don't understand is what I need to do in the attribute-resolver.xml
file.  

For the normal case of the IdP pushing an attribute assertion as part of
an authN response, I use the user's internal Harvard Id "(
harvardeduidnumber") as the key to pull attributes from our LDAP (HULDAP).
 Here's  the stanza for that (with some contents removed):

    <resolver:DataConnector id="HULDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldaps://hu-ldap-test.harvard.edu:636"
        baseDN="ou=people,o=Harvard University Core,....
        principal =....
        principalCredential=...
        <dc:FilterTemplate>
            <![CDATA[
                (harvardeduidnumber=${requestContext.principalName})
            ]]>
        </dc:FilterTemplate>



Let's say that email address gets passed in on the attribute Query  as the
NameID.  From within the resolver, I can find the harvardeduidnumber from
email address using HULDAP -- but not with the definition I currently
have.   Do I set up another DataConnector element that refers to the same
LDAP but with a different ID?   If so, what else do I need to do?

As you probably tell, I'm having trouble finding the thread of actions
that connect the email address to the harvardeduidnumber, and then the
extracted  harvardeduidnumber to the CDATA line in the HULDAP definition
that expects to get the harvardeduidnumber from the
requestContext.principalName  (I have a second case where I get the
harvardeduidnumber from a source other than HULDAP, but I'm still left not
knowing how to hook up that value to the HULDAP definition that currently
relies on requestContext.principalName.)

I have the sense that Principal Connectors are involved -- but I don't
understand how.

I apologize if I've overlooked some Wiki-available info here.

Thank you so much!
Marlena

Harvard University Information Technology
Innovation & Architecture
Senior Technologist
(Mobile) +1 (617) 872-9736
1033 Mass Ave, 4th Floor
Cambridge, MA 02138