Attribute Definition activation condition

[Cantor, Scott]

> I have an attribute that is only interesting after authentication for selecting
> further authentication flows, noted with `idp.authn.resolveAttribute`. In
> working through an activation condition, I’ve noticed that no matter what I
> set, the activation condition doesn’t seem to respected (e.g., I’d set it to one
> that always returns false, and the attribute would still be resolved).

I don't know exactly in what spot the condition is checked or how it's logged, but the activation condition can't possibly stop the resolver from asking it to resolve itself, the condition runs inside the plugin. It should simply short-circuit anything coming back. If it's not, that would be a bug (or the condition isn't configured).

> I’ve found a way around this for the short term by controlling the Data
> Connector, though this seems like it might be overkill and might cause
> problems later on.

Well, given the work involved, it's more common to run connectors conditionally, I would say.

> Relatedly, is there an inbuilt way to configure an attribute to only be resolved
> during/before authentication and not during attribute resolution?

I don't believe there's anything exposed to provide a list of what to resolve during the normal stage.

-- Scott