Attribute resolver vs. script

Cantor, Scott cantor.2 at
Thu Dec 3 15:33:05 EST 2015

On 12/3/15, 3:31 PM, "users on behalf of Cantor, Scott" <users-bounces at on behalf of cantor.2 at> wrote:

>On 12/3/15, 2:27 PM, "users on behalf of Dave Bartholomew" <users-bounces at on behalf of Dave.Bartholomew at> wrote:
>>For both IdP 3.x and 2.x (I would guess no difference), if I want to return one of two separate (different attribute) e-mail addresses to an SP based on the user’s eduPersonPrimaryAffiliation (we provide separate staff/faculty and student e-mail accounts), is that doable using attribute-resolver configuration or is scripting my only choice?
>I think you can probably get creative with the Mapped or Template definitions if you really wanted to. Scripts with Rhino at least are simple enough that I'm not sure you're gaining much.

And arguably even worse would be defining separate attributes for the different email types and then selectively filtering which of those to release based on the value(s) in the affiliation attribute.

-- Scott

More information about the users mailing list