Attribute resolver and failed data connector

[Cantor, Scott]

On 7/28/17, 9:38 AM, "users on behalf of Michael A Grady" <users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:

> That error causes the resolver to end up without an "Attribute Context", even though the LDAP connector succeeded and pulled
> in attributes.

The way it has always worked, a true "error" in any connector or definition fails the entire process, never just one thing. The reason is that we have no way to know whether the failure has a corrupting influence on the rest of the data being returned.

There is a lot of inconsistency over the failure/error behavior in the individual connectors, and I hope we get that fixed at some point with a higher level setting that just allows any connector's errors to be masked. Without that, you pretty much need failovers in place.

We have decent control over mapping result set sizes to success/failure, but not the failure modes.

Also, note that it's possible to fail requests to the IdP if the resolver throws. That's a property setting.

-- Scott