Scripted Attributes slow?

[Lukas Hämmerle]

We consider to recommend our universities to extend the
eduPersonAffiliation attribute with the 'member' value using a scripted
attribute. The script in the attribute-resolver.xml could then look like:

-------------------------------------------------------------------------
<ad:Script>
  <![CDATA[

importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);

  if (
       eduPersonAffiliation.getValues().contains("staff")
    || eduPersonAffiliation.getValues().contains("student")
    || eduPersonAffiliation.getValues().contains("faculty")
    || eduPersonAffiliation.getValues().contains("employee")
    ) {
    eduPersonAffiliation.getValues().add("member");
  }
  ]]>
</ad:Script>
-------------------------------------------------------------------------


However, from a commercial solution provider that offers hosted SAML
IdPs we heard that the Shibboleth Identity Provider performs slow when
using scripted attributes. This is one of their selling points apparently.

>From our own experience with our Virtual Home Organization (36'000
accounts, 7500 daily logins on average) and 3 more complex scripted
attributes than above, we cannot confirm this but maybe this IdP is not
used sufficiently to experience any performance issues.

Therefore, we would be interested to hear whether this is the case/has
ever been the case. Any experiences?


Best Regards
Lukas

-- 
SWITCH
--------------------------
Lukas Hämmerle, Central Solutions
Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland
phone +41 44 268 15 05, direct +41 44 268 15 64
lukas.haemmerle at switch.ch, http://www.switch.ch