Using x509 login data in ldap data connector

[Cantor, Scott]

> We are using shibboleth3 with x509 login. The login itself looks fine,
> but now we would like to get the certificate serial number with CA or at
> least the DN of the certificate for the ldap search.

The certificate is inside the Java Subject's public credential set. The Subject(s) are available as of 3.3 to the context of scripted attributes and connectors as a subjects array, so using a scripted connector or attribute definition to pull out the information and then leverage that as a dependency in an LDAP connector is the easiest way I suspect.

> Is there a way to somehow display the $resolutionContext?

Not easily, no. Brent built a helper to dump out the context tree, but it's not usable outside of maybe scripting I guess. As I said, we are greatly lacking documentation of the general information exposed to the resolver.

-- Scott