IDPv3 Attribute Resolver help

[Peter Schober]

> I'm trying to pass through a handful of required attributes, but
> whatever I do those attributes are never sent. Are there any step by
> step guides on how to get this to work?

Logging is key here, and data not being sent is another, later step.
The logs (on DEBUG) will tell you exactly what attributes have been
resolved, with how many values, and whether or why not they will be
released.

> The immediate problem seems to be the LDAP dataconnector in
> attribute-resolver.xml, which is complaining about the lack of a
> trustCertificate. What is this and how do I set one up?

$ fgrep trustCertificate conf/ldap.properties

> Alternatively, since this is only intended as a test system, can I
> disable the requirement for such a certificate?

If your LDAP server services requests without any transport layer
security at all you could probably set both useStartTLS and useSSL to
false as well as supply an ldap:// URL for the server.

Personally I'd only do that in conjunction with SASL binds that
provide a security factor (not "PLAIN"), and certainly not with simple
binds, to prevent at least passwords from going over the wire in the
clear, but your call.

> Also, since I already have a trust credential set up to enable the
> basic authentication to work, what is the point of this certificate?
> I would have expected the trust credential to be sufficient.

Most deployers will want to protect data (and potentially passwords)
from being transmitted in the clear, which usually means TLS.
The parameter you ask about (and idp.authn.LDAP.authenticator more
specifically) are for fine-tuning the technical trust from the IDP as
LDAP client to the LDAP server.
-peter