Limiting persistentId resolving
Rod Widdowson
rdw at steadingsoftware.com
Fri Aug 9 09:01:24 EDT 2019
> I would like to limit eduPersonTargetedId resolving based on AttributeConsumingService of the current relying party.
That should be OK, but beware that a lot of people have recently been re-discovering that you do *not* have access to any resolved
attributes when evaluating conditions in the context of attribute resolution: it's "too soon".
We are aware of this issue and are looking at ways to make life easier in V4.
> I try to access requestedAttribute list with a ActivationCondition. This condition is call in
> activationConditionRef property on eduPersonTargetedId's
> AttributeDefinition and storeId DataConnector in attribute-resolver.xml.
requestedAttributes is rarely populated and it being empty means "all"..
My suggestions of things to try are
1) (If relevant) Make all dependencies of your StoredIDDataConnector are protected by same the activation condition. Dependencies
and activation conditions do not interact - a dependency is resolved even if the resolver which depends on it is turned off by an
activation condition
2) Make your activation condition just RP dependant (if that makes sense)
3) Add a failover static (or scripted) connector.:
3a) If producing no EpTID under the "no Database" circumstances is "good enough" fallback to a Static data connector which resolves
nothing...
3b) If you really need the resolution to fail (rather than silently produce no EpTID) try a scripted connector. This would have
access to all the dependencies and return either nothing (which should be like saying "FALSE"/I don't need this in the
activationCondition) or throw an exception if it really has to fail.
More information about the users
mailing list