Providing attributes from CAS

[Cantor, Scott]

On 4/8/13 2:11 PM, "Joshua Riffle" <jriffle at apu.edu> wrote:

>The data resolver for LDAP uses requestContext.principalName to connect
>to LDAP which in our case is filled-in by the user name that was
>authenticated by CAS. See the example 3 (Define the Search Parameters):
>https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConne
>ctor

And to speak to that a little, a common model is to take the username from
the authentication step and feed it into the LDAP or database connector.
Then the actual user identity pushed into an attribute later is taken from
a data connector "field", meaning something pulled from the store.

But it doesn't have to be done that way, it can be accesssed and fed into
some of the attribute definitions directly. Some, not all. Probably my
note mentioning Scoped/Prescoped is wrong, I think those only operate on
data connector sourced fields. Might even be true of Template.

I know Principal operates directly on the internal username, and I know a
Scripted definition can also access it.

-- Scott