MFA attribute for CAS serviceValidate

[Cantor, Scott]

On 4/12/17, 3:31 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

> I think what I was thinking of is a thing called SubjectDerivedAttributeValuesFunction, which is an impl class. I think what it does
> is facilitate pulling attribute values out of the Subject. I don't know if it's documented or not.

Ok, I'm not crazy, there is an attribute definition type called SubjectDerivedAttribute [1].

It needs to get linked into the documentation, just an oversight.

I believe what it allows is a simpler script to be written to implement a function that will get the desired attribute values out. What it was originally programmed to do is to handle the case of an IdPAtttributePrincipal, which is a way of passing attributes over from the External login flow. But it can take a function to change what it does, and it handles all the "get at the Subject's Principals" logic. I believe what it does is call a function supplied for every Principal. So a bit of a shortcut.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/SubjectDerivedAttributeAttributeDefinition