Can a Shibboleth IdP release the internal LDAP attribute "pwdChangedTime" to a Shibboleth SP?

[Peter Schober]

* Marco Malavolti <marco.malavolti at garr.it> [2013-09-20 09:38]:
> today I would understand if there is a solution for a Shibboleth IdP
> to send the internal LDAP attribute "pwdChangedTime", included into
> ppolicy.schema <http://www.zytrax.com/books/ldap/ape/ppolicy.html>,
> to a Shibboleth SP.

"Operational" is the term for those "internal" attributes, with two
main specifics being that (a) they are mantained by the DSA and don't
allow modification and more relevant to your question here (b) are
only returned in search results when explicitly being asked for.

So you'll need to add a <dc:ReturnAttributes> element to your LDAP
data connector in attribute-resolver.xml and include pwdChangedTime in
the list of attributes you want returned from the DSA.

The caveat being that the DSA will then only release those attributes
being asked for, operational or not -- unless the DSA has
configuration or syntax to change that behaviour. (I have not tried
combining the RFC3673 defined behaviour with requesting all
non-operational attributes via a wildcard or whatever.)
So if you didn't already specify ReturnAttributes in your connector
config so far (and relied on ACLs at the DSA to control attribute
release to your IDP) you'll probably need to explicitly list any and
all attributes you want returned from LDAP to your IdP. Which means
changing (and auto-reloading or restarting the container) your
resolver configuration when you want to include a new LDAP attribute
in your IdP processing.
-peter