Attribute Definition activation condition

[Jonathan Johnson]

Great, thanks for the confirmation! Makes sense, and I’ll consider it expected behavior.

I’ll go with what works, and hope for the best.

-Jj

On February 29, 2016 at 11:05:55, Cantor, Scott (cantor.2 at osu.edu) wrote:

> I have an attribute that is only interesting after authentication for selecting  
> further authentication flows, noted with `idp.authn.resolveAttribute`. In  
> working through an activation condition, I’ve noticed that no matter what I  
> set, the activation condition doesn’t seem to respected (e.g., I’d set it to one  
> that always returns false, and the attribute would still be resolved).  

I don't know exactly in what spot the condition is checked or how it's logged, but the activation condition can't possibly stop the resolver from asking it to resolve itself, the condition runs inside the plugin. It should simply short-circuit anything coming back. If it's not, that would be a bug (or the condition isn't configured).  

> I’ve found a way around this for the short term by controlling the Data  
> Connector, though this seems like it might be overkill and might cause  
> problems later on.  

Well, given the work involved, it's more common to run connectors conditionally, I would say.  

> Relatedly, is there an inbuilt way to configure an attribute to only be resolved  
> during/before authentication and not during attribute resolution?  

I don't believe there's anything exposed to provide a list of what to resolve during the normal stage.  

-- Scott  

--  
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160229/7454575b/attachment-0001.html>