Can a Shibboleth IdP release the internal LDAP attribute "pwdChangedTime" to a Shibboleth SP?

[Peter Gietz]

Am 23.09.2013 17:17, schrieb Christopher Bongaarts:
> On 9/20/2013 3:03 AM, Peter Schober wrote:
>> So you'll need to add a <dc:ReturnAttributes> element to your LDAP
>> data connector in attribute-resolver.xml and include pwdChangedTime in
>> the list of attributes you want returned from the DSA.
>>
>> The caveat being that the DSA will then only release those attributes
>> being asked for, operational or not -- unless the DSA has
>> configuration or syntax to change that behaviour.
> FWIW, Oracle (formerly Sun) Directory Server, Enterprise Edition accepts
> this syntax to get all non-operational attributes, plus the operational
> attribute "isMemberOf":
>
> <ReturnAttributes>* isMemberOf</ReturnAttributes>
>
OpenLDAP also supports this. You can also get all operational attributes 
returned in addition to the user attributes via  "* +" as specified in  
RFC 3673.

Cheers,

Peter

-- 

Peter Gietz, CEO

DAASI International GmbH
Europaplatz 3
D-72072 Tübingen
Germany

phone: +49 7071 407109-0
fax:   +49 7071 407109-9
email: peter.gietz at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz