Can an intercept trigger a re-resolution of attributes?

[Christopher Bongaarts]

On 8/3/2016 2:06 PM, Cantor, Scott wrote:
>> I'm starting to wonder if I need to do something within the regex
>> >predicate (which is basically just the abstract attribute predicate with
>> >the match method overridden to check regex instead of the string map).
> The predicate also has to have a matching strategy function injected to
> locate the context, and I don't know offhand what the default is. I
> assume it's also going to look under the RP context.

Bingo!  Since 99.999% of the time the attribute predicate will be used 
somewhere that wants to use the "standard" resolution results, it 
defaults to RPC->AC.  Configuring the predicate bean with the same 
strategy as the Resolve action bean makes it work.

    <bean id="isPasswordExpired" 
class="edu.umn.oit.idm.shib.RegexAttributePredicate"
       p:pat="^[Xs].*" p:attributeId="umnPasswordStatus"
p:attributeContextLookupStrategy-ref="shibboleth.ChildLookupOrCreate.AttributeContext"/>

I suspect using the child lookup or create helper is fine here despite 
this strategy being lookup only.

The data connector appears to still read all the attributes - doesn't 
appear that simply defining the attributesToResolve on the resolve 
action bean is sufficient to limit it at that level, though it does dump 
all the attributes except for the attributesToResolve after looking them 
up.  It may end up faster that way anyway in our environment, since LDAP 
can leverage its entry cache if nothing's changed yet.

One piece still left that I haven't verified: since there may be a few 
minutes delay while the user changes their password, the RP context 
attributes may no longer be current, so I might need to re-resolve the 
"real" attributes when the user finally gets through, in order for them 
to be "current".  This would of course only affect SPs that receive 
attributes that are likely to have changed (certainly the password 
status and last password change time).  Of course, now I have a pretty 
good idea of how to do that :)

Thanks as always for all your help and advice!

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160804/0aae0114/attachment.html>