Issues with attribute-resolver.xml and Active Directory Attributes

[Cantor, Scott]

On 3/31/17, 6:04 PM, "users on behalf of Andrew Klaus" <users-bounces at shibboleth.net on behalf of andrew.klaus at cybera.ca> wrote:

> Why is it that the "uid" Attribute Definition can be used without specifying a Dependency, but I can't do the same with
> displayName (or others)?

They are of totally different types. The "uid" example is type Principal, which means it's populated with the principal name. The others are type Simple which means they come from some underlying data you have to supply, which is supplied with a Dependency.

> If I'm already able to get uid from the AD connection, I shouldn't need to create a "myLDAP" DataConnector do I?
>  That seems rather redundant.

You're not getting uid from the AD connection, you're getting it from the output of the authentication sequence. Excluding some specialized cases, that's *all* you're going to get out of the authentication process. You always (*) need a data connector if you want attributes.

-- Scott