Can a Shibboleth IdP release the internal LDAP attribute "pwdChangedTime" to a Shibboleth SP?

[Christopher Bongaarts]

On 9/20/2013 3:03 AM, Peter Schober wrote:
> So you'll need to add a <dc:ReturnAttributes> element to your LDAP
> data connector in attribute-resolver.xml and include pwdChangedTime in
> the list of attributes you want returned from the DSA.
>
> The caveat being that the DSA will then only release those attributes
> being asked for, operational or not -- unless the DSA has
> configuration or syntax to change that behaviour.

FWIW, Oracle (formerly Sun) Directory Server, Enterprise Edition accepts 
this syntax to get all non-operational attributes, plus the operational 
attribute "isMemberOf":

<ReturnAttributes>* isMemberOf</ReturnAttributes>

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%