Obtaining IDP attributes, which method is appropriate?

[Losen, Stephen C. (scl)]

Hi folks,

I can see two ways of obtaining attributes in scripts/views.

In the authn/MFA transition map example script I see that you drill down like this:

ProfileRequestContext -> AttributeResolutionContext

and you need to pass "shibboleth.AttributeResolverService" as a "custom" bean to the script.

But from the users at shibboleth.net archives I see that velocity views can drill down like this:

ProfileRequestContext -> RelyingPartyContext -> AttributeContext

Is the former method necessary for authn/MFA because authentication has not completed?

Does the latter method work only after authentication has completed?

Can post authentication intercept scripts also use this method?

Thanks,


Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640