Conditioned attribute

[Peter Schober]

Jan Marek via users <users at shibboleth.net> [2024-07-08 11:27 CEST]:
> idp.authn.LDAP.returnAttributes = "uid cn eduPersonAffiliation
> eduPersonEntitlement eduPersonPrimaryOrgUnitDN
> eduPersonPrimaryAffiliation eduPersonOrgUnitDN sn ou givenName
> uidNumber businessCategory pager mail displayName"

And you do need all those attributes *during* *authentication*?
(I.e., what you're doing here is not the purpose of
idp.authn.LDAP.returnAttributes, AFAIK.)

Do you even need DataConnector/@exportAttributes to be set with all
the above data? I.e., does your LDAP DSA only return those attributes
if you're asking for them by name?  Does the LDAP DSA return uid and
displayName when you ask for them using e.g. ldapsearch (or any other
LDAP client)?
  Even if so you could add those to your resolver config and not have
any of these within idp.authn.LDAP.returnAttributes.

That may not change anything wrt the issue you're still seeing, though
(which I don't quite understand, yet).

-peter