resolver search filter

[Klingenstein, Nate]

Tom,

> (uid=$requestContext.principalName)
> (uid=$resolutionContext.principal)

As far as I could tell, the two are equivalent in practice, but the former is deprecated.

> I can guess,

I'm answering this with my guess under the "fresh eyes" principle in hopes it will get more details in a real answer.

https://wiki.shibboleth.net/confluence/display/IDP30/GeneralArchitecture#GeneralArchitecture-Contexts

As I understood it, the requestContext and the resolutionContext are different "context"s entirely.

A "requestContext" doesn't make sense to me as a concept in 3.x because it isn't really structured around singular requests in any sense, whether that's an HTTP Request or an AuthnRequest.

A "resolutionContext" is immediately clear to me: that's the context in which attribute resolution occurs, which is after canonicalization,

I have no idea if this gets tangled up with Java Principals versus the concept of a principal or whether a user can have multiple Principals in this sense.  If I'm confused, it's there.

> Which filter, if any, would be more correct for an external authenticator?

I'm sure the resolutionContext is more correct in all cases.  I have no idea why that is.

Your friendly shot in the dark downstate,
Nate.