A confusing attribute resolver configuration
Peter Schober
peter.schober at univie.ac.at
Thu Oct 22 02:43:41 EDT 2015
* Wessel, Keith <kwessel at illinois.edu> [2015-10-21 17:35]:
> What I'd like to do is have my attribute definition for givenName
> use the value of uiucEduFirstName from the campus LDAP and givenName
> from AD. The user will never exist in more than one place.
TIMTOWTDI. Another method without needing v3 or a Script (untestet):
Define two Simple attribute definitions for each variant, with the
proper sourceAttributeID and Dependency on the approproate
DataConnector (adjust refs as needed), without any encoders and
with dependencyOnly="true" set (left out below for brevity), and then
have one "master" attribute definition (with the encoders present)
depend on the two others. Something like this:
<resolver:AttributeDefinition xsi:type="ad:Simple" id="campusGivenName" sourceAttributeID="uiucEduFirstName">
<resolver:Dependency ref="myLDAP" />
</resolver:AttributeDefinition>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="ADGivenName" sourceAttributeID="givenName">
<resolver:Dependency ref="myAD" />
</resolver:AttributeDefinition>
<resolver:AttributeDefinition id="givenName" xsi:type="ad:Simple" sourceAttributeID="givenName">
<resolver:Dependency ref="campusGivenName" />
<resolver:Dependency ref="ADGivenName" />
<resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" />
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" />
</resolver:AttributeDefinition>
-peter
More information about the users
mailing list