IDP -- need to query attribute store with two different search filters

[Steven Carmody]

Hi,

Our community does the standard the userid/password login to our IDP; we 
then query our ldap server for attributes using this filter:

	(uid=[entered value])

However, we've recently started adding "eternal users" to a new, 
separate OU in our ldap server. These users do NOT have a uid value in 
their user object; however, they do have an EPPN value.

We now have Shib SPs that have a SimpleAggregation AttributeResolver in 
their config. Users authenticate at their home institution; this SP then 
issues an AttributeQuery to our local IDP, passing the asserted EPPN 
value as the Subject/NameID value. The SPs expectation is that the IDP 
would search the local ldap using a filter like

	(eduPersonPrincipalName=[EPPN value])

The SPs want to know whether this external person is a member of any 
local groups. The external person might have local privileges and 
permissions, depending on their memberships.

I'm stumped, however, as to how to configure the IDP's 
attribute-resolver file, and in particular the ldap DataConnector 
element, so that a single IDP could handle both of these situations.

It has occurred to me that if I could configure the SP's 
AttributeResolver to do an ldap lookup rather than an IDP query, my 
problem would be solved. But, I don't see any documentation or 
contributions supporting that possibility.

It has also occurred to me that, for external users only, we might put 
their EPPN value in the uid field. But, I hesitate to think of what the 
author of the ldap cookbook would do to me when next we meet if I were 
to even mention that idea.  ;-)

All suggestions welcome!

Thanks !