Refusing to send an assertion if attribute not present?

[Cantor, Scott]

On 3/12/13 4:49 PM, "Erdos, Marlena" <marlena_erdos at harvard.edu> wrote:

>That is, I'm wondering if there is any hook with the
>attribute-resolver.xml file to let me stop the process and return an error
>page to the user.  (I've searched for such a hook, but that's not been
>fruitful. Maybe I'm just using the wrong terms?)

The resolver has no UI and doesn't even assume the user's present, so it
does not deal in such things. If you want to avoid authentication
altogether, you can use a search filter as the other responder mentioned.
If you want UI control post-authentication, you would need a custom login
handler, there is no such hook in V2. Some of my contributed code includes
that kind of thing, as have others'.

>I'm using external authentication, so my alternative is to check for
>presence of the attribute in the the external authN callback servlet --
>and maybe that's the place to do it, but I figured I'd ask.  (It seems
>"wasteful" to be pulling attributes from LDAP twice -- once in the
>callback and then again in the resolver.)

Well, doing it with custom code inside the IdP has the advantage of
running the resolver such that the caching prevents extra lookups, but
LDAP should be fast enough to make that a non-issue.

-- Scott