Two AD data connectors issue with Attribute-resolver

[Douglas E Engert]

You may need a three resolvers something like this:


     <resolver:AttributeDefinition id="AD1eduPersonPrincipalName" xsi:type="ad:Prescoped" sourceAttributeID="mail">
         <resolver:Dependency ref="AD1" />
     </resolver:AttributeDefinition>


    <resolver:AttributeDefinition id="AD3eduPersonPrincipalName" xsi:type="ad:Prescoped" sourceAttributeID="mail">
         <resolver:Dependency ref="AD3" />
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition id="eduPersonPrincipalName"  xsi:type="Script" ... >
        <resolver:Dependency ref="AD1eduPersonPrincipalName" />
        <resolver:Dependency ref="AD3eduPersonPrincipalName" />
        <Script><![CDATA[

        pick one, resolve conflicts if both exist and not the same...

        ]]></Script>
        <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" />

     </resolver:AttributeDefinition>



On 10/14/2015 3:09 PM, Cantor, Scott wrote:
> On 10/14/15, 4:00 PM, "users on behalf of Colon, Joseph" <users-bounces at shibboleth.net on behalf of JColon at APUS.EDU> wrote:
>
>
>
>> Thanks for the info Scott,
>>
>> So if I have 2 domains, AD1 and AD3.  Is there any way to return an attribute like "mail" back to the SP no matter which domain the user exists in?
>
> There are usually a dozen ways to do anything with the resolver. Failover connectors running in sequence is one way, another would be using separate attributes from each domain and then merging the results together.
>
> -- Scott
>
>>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>