cannot pull isMemberOf attribute

[Christopher Bongaarts]

On 3/7/2014 4:13 AM, Cameron Kerr wrote:
> Suggest you only request the attributes you need; you'll get better LDAP performance that way.

Better IdP performance, probably, as it might not need to parse as much 
response data.

LDAP server performance may vary.  Some servers have an "entry cache" 
with the data preformatted and ready to go if the entry has been 
requested recently. If Shib's view is identical to any other significant 
LDAP consumer, requesting specific attributes might decrease the number 
of cache hits.

If we don't have a "tuning Shib and LDAP settings for max performance" 
page in the wiki, it might be a handy thing to have.

> Also, remember that you can filter attribute values, which generally is useful to do if using this to release group information about a user.

We use both techniques - scripted attributes that calculate 
eduPersonAffiliation/Entitlement well-known values on the fly based on a 
base attribute's values, and attribute filter policies that selectively 
release values to SPs based on what they actually need. This includes 
both exact matching (e.g. ePA value "member"), and regex matches (e.g. 
for an SP dept.umn.edu, release groups of the form 
"*,ou=Department,o=University of Minnesota,c=US").

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%