DataConnector Delay

[Michael A Grady]

> On Dec 28, 2016, at 9:12 PM, Mr. Christopher Bland <chris at fdu.edu> wrote:
> 
> You mention direct membership, which I am doing.  I took this approach because it flattens out all of the memberOf attributes into one.  Are you querying memberOf differently?

Not quite what I meant. I meant having the user be a direct member of the groups you need to rely on to determine eduPersonAffiliation, rather than having their membership within that group potentially rely on subgroups that are then members of those groups. It's only when you rely on subgroups/groups as members of groups that you need to worry about recursing thru the groups, versus just accessing each person's memberOf attribute. memberOf being an attribute that AD dynamically calculates for you (much more efficiently) based on direct memberships of that user in groups. If you flatten out the groups needed to determine affiliation, as part of provisioning/maintaining user information in AD, then you don't need to recurse in the first place.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20161229/8187c6e3/attachment-0001.sig>