A confusing attribute resolver configuration

[Wessel, Keith]

Thanks, Peter. I was trying to do something similar to this yesterday, but only for mapping uiucEduFirstName to another attribute name. I see here that, by doing it for both the AD and the LDAP attributes then including those internal attributes as dependencies, it might work. Only question is what does the source attribute ID of givenName on the givenName attribute definition accomplish? Clearly one of the internal attributes (the AD given name) is pulling in given name, but that doesn't matter to the givenName attribute definition since it's referencing the internal attribute definition, not the directory attribute.

More simply put, if I have an attribute definition that has two dependencies, both of which are other attributes instead of data connectors, what role does the sourceAttributeID play in the definition of that attribute definition?

Thanks, too, for the clarification on the V3 solution.

Keith

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Thursday, October 22, 2015 1:44 AM
To: users at shibboleth.net
Subject: Re: A confusing attribute resolver configuration

* Wessel, Keith <kwessel at illinois.edu> [2015-10-21 17:35]:
> What I'd like to do is have my attribute definition for givenName
> use the value of uiucEduFirstName from the campus LDAP and givenName
> from AD. The user will never exist in more than one place.

TIMTOWTDI. Another method without needing v3 or a Script (untestet):
Define two Simple attribute definitions for each variant, with the
proper sourceAttributeID and Dependency on the approproate
DataConnector (adjust refs as needed), without any encoders and
with dependencyOnly="true" set (left out below for brevity), and then
have one "master" attribute definition (with the encoders present)
depend on the two others. Something like this:

<resolver:AttributeDefinition xsi:type="ad:Simple" id="campusGivenName" sourceAttributeID="uiucEduFirstName">
  <resolver:Dependency ref="myLDAP" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="ADGivenName" sourceAttributeID="givenName">
  <resolver:Dependency ref="myAD" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition id="givenName" xsi:type="ad:Simple" sourceAttributeID="givenName">
  <resolver:Dependency ref="campusGivenName" />
  <resolver:Dependency ref="ADGivenName" />
  <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:givenName" />
  <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.42" friendlyName="givenName" />
</resolver:AttributeDefinition>

-peter
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net