v3 Docs Q: Appropriate use of idp.authn.LDAP.returnAttributes?

[Cantor, Scott]

On 6/29/15, 10:58 PM, "users on behalf of Daniel Fisher" <users-bounces at shibboleth.net on behalf of dfisher at vt.edu> wrote:
>
>One reason to pull attributes during authentication is that it is the only time you can read attributes as the authenticating user. For some directory implementations it is attractive to simply exercise the user ACLs rather than configuring a service account to read that data.

While that's true, it isn't as simple to punt everything the data connector does over to this step. I suppose if you wanted to make that more "routine", you could write a data connector that automatically generated IdPAttributes based on the LdapEntry in the Subject.

I guess a sample Script could be written to plug into the ScriptedDataConnector.

-- Scott