Two DataConnectors overwrite each other

[Moritz Reichelt]

I have two DataConnectors (LDAP and relational DB), both sources contain a mail attribute. Some users are stored exclusively in LDAP and the rest is stored in our DB.



I want the IDP to export an attribute called mail that contains either the value from LDAP when the user is stored in LDAP, or the value from the DB when the user is stored in our DB.



However for users stored in our DB, this is what happens: first IDP tries to resolve the attribute from our DB (which succeeds), and then it tries to ask LDAP (which fails => mail is null and gets filtered out). This means that for users stored in our DB, no mail attribute is exported.



I read about Activation Conditions<https://wiki.shibboleth.net/confluence/display/IDP4/ActivationConditions> in the wiki which might help me solve this problem, i.e. only run the second data connector when the first one did not retrieve a value. But I am having trouble understanding the examples given and I am kind of desperate now trying to solve my problem.



Any help would be greatly appreciated.



Moritz Reichelt

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210409/8bc3823e/attachment.htm>