Limiting persistentId resolving

[GAMBINI Gilian]

Hello,

We use a mariaDB database to store persistentId. This attribute is required by a very small number of relying party in our federation (maybe less than 5%).

When database is unavailable, every relying party cant use our identity provider. Using "onlyIfRequired" property in a attribute filter's rule don't work because eduPersonTargetedId (=persistentId) is always resolved and a failure equals to no attribute set in saml response (https://wiki.shibboleth.net/confluence/display/IDP30/AttributeFilterConfiguration#AttributeFilterConfiguration-Errorhandling).
Moreover, identity provider create a persistentId for each new couple of user/relyingParty, if needed or not.

I would like to limit eduPersonTargetedId resolving based on AttributeConsumingService of the current relying party. I try to access requestedAttribute list with a ActivationCondition. This condition is call in activationConditionRef property on eduPersonTargetedId's AttributeDefinition and storeId DataConnector in attribute-resolver.xml.

I dont know how access current entityId's metadata in this activationCondition. I find a method getRequestAttributes() from AttributeConsumingServiceImpl class in opensaml javadoc but i dont know if i can use it.
https://build.shibboleth.net/nexus/service/local/repositories/site/content/java-opensaml/3.4.3/apidocs/org/opensaml/saml/saml2/metadata/impl/AttributeConsumingServiceImpl.html

Maybe someone here have try to do something like this ? Did you have any hints or example ?
Thank you.

Regards, Gilian.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190808/06db2cba/attachment.html>