v3 Docs Q: Appropriate use of idp.authn.LDAP.returnAttributes?

[Cantor, Scott]

On 6/29/15, 2:37 PM, "users on behalf of Chris Phillips" <users-bounces at shibboleth.net on behalf of Chris.Phillips at canarie.ca> wrote:

>
>What are the recommendations/guidance for how the community should use idp.authn.LDAP.returnAttributes?

I believe if it's not set, the default is to return all attributes on the user's entry, so obviously one use case is to optimize that, much like it is with the attribute resolver.

The functional purpose is to pull back data that's used to analyze account state or to control the LdapEntry object that gets put into the Subject the login flow generates. It's not just a username (that's there too of course).

The former is for triggering flows for things like expiring passwords or locked accounts.

The latter would normally be used in one of two ways:

- in a custom c14n flow that was written to remap the username from what was entered to something that came back in the LdapEntry

- in the attribute resolver via a script (which could access the Subject to get at that extra data)

Both of those use cases are things you can do more easily with the attribute resolver and without writing code or scripts, but that does mean extra LDAP binds, so I guess there's an efficiency argument in rare cases, but certainly not routinely.

>Can I leave it blank until then?

Yes, same as the resolver equivalent.

-- Scott