attribute access from login handlers

[Russell Beall]

Hi, 

I know this topic has been addressed in previous threads, but I didn't find a definitive answer on how it should be done.

I am working on building a login handler which will make a decision based on a user attribute and rather than making an out-of-band LDAP call, would like to simply access the resolver.

I know this has been done, and I just witnessed the good presentation by David Langenberg from Chicaco regarding their custom login handler which makes a decision based on attributes relating to level-of-assurance.

I am hoping someone out there, perhaps David, has a definitive code snippet which gives the example of the best way to access the resolver during authentication.

So far my attempts to dig into the API have been unusually fruitless and full of twists and complications which make it seem untenable to efficiently access the resolver.  Normally I would have figured it out by now...

Thanks for any help,
Regards,
Russ.