Attribute Queries: Needed set up?

[Cantor, Scott]

On 4/4/13 8:26 PM, "Erdos, Marlena" <marlena_erdos at harvard.edu> wrote:
>
>I have the sense that Principal Connectors are involved -- but I don't
>understand how.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPNameIdentifier

See Accepting the Name Identifier.

There's no built-in principal connector for LDAP. There's nothing to do an
LDAP query on a piece of data to return a different piece of data to use
as the principal name.

But the Direct connector will populate any NameID directly into the
principal name so if you modify your data connectors so that they can look
up data by whatever that value is, that will work out of the box.

e.g.

<dc:FilterTemplate>
            <![CDATA[
(|(harvardeduidnumber=${requestContext.principalName})(mail=${requestContex
t.principalName}))
            ]]>
        </dc:FilterTemplate>


Modulo that's probably wrong since LDAP isn't my bag, but something like
that. Search on either field, basically.

-- Scott