Attribute resolver and failed data connector

[William Holcomb]

I am new on the scene.  Who can point me to courses to learn Shibboleth/SSO?  Thanks in advance!

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, July 28, 2017 10:06 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Attribute resolver and failed data connector

On 7/28/17, 9:38 AM, "users on behalf of Michael A Grady" <users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:

> That error causes the resolver to end up without an "Attribute 
> Context", even though the LDAP connector succeeded and pulled in attributes.

The way it has always worked, a true "error" in any connector or definition fails the entire process, never just one thing. The reason is that we have no way to know whether the failure has a corrupting influence on the rest of the data being returned.

There is a lot of inconsistency over the failure/error behavior in the individual connectors, and I hope we get that fixed at some point with a higher level setting that just allows any connector's errors to be masked. Without that, you pretty much need failovers in place.

We have decent control over mapping result set sizes to success/failure, but not the failure modes.

Also, note that it's possible to fail requests to the IdP if the resolver throws. That's a property setting.

-- Scott



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net