Limited attribute resolution per entityID

[Cantor, Scott]

The IdP can't know for a given request how much of the tree is required to produce whatever the final result will be, it has no idea what would eventually be released.

There is no "working backwards" because the filter layer cannot answer the question "what will be released?" only "what of the following content should I release?"

We also provide mechanisms to limit connectors as required anyway, it's just at the opposite end of the configuration. So in the end it would be a distinction without a difference to move what's already possible in the activation condition layer over to the front end outside the resolver.

Even so, I added a formal means of including SAML RequestedAttribute elements into the configuration as an "override" of the comparable feature that is supported in an AuthnRequest or in metadata, in the same way we allow one to dictate/override the ForceAuthn flag and many other things an SP can request. That's more or less the same thing as configuring attribute IDs to resolve, it's just expressed in SAML terms and not IdPAttribute terms.

-- Scott