<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 8/4/2016 5:54 PM, Cantor, Scott wrote:<br>
<blockquote cite="mid:0844f174-bcf1-4c2d-151c-ba24d32aa9fb@osu.edu"
type="cite">
<blockquote type="cite" style="color: #000066;">
<pre wrap="">The data connector appears to still read all the attributes - doesn't
<span class="moz-txt-citetags">> </span>appear that simply defining the attributesToResolve on the resolve
<span class="moz-txt-citetags">> </span>action bean is sufficient to limit it at that level, though it does dump
<span class="moz-txt-citetags">> </span>all the attributes except for the attributesToResolve after looking them
<span class="moz-txt-citetags">> </span>up. It may end up faster that way anyway in our environment, since LDAP
<span class="moz-txt-citetags">> </span>can leverage its entry cache if nothing's changed yet.
</pre>
</blockquote>
<pre wrap="">If you resolve an attribute, it will resolve the dependencies of just
that attribute, but if that's still your main LDAP query, then it's
going to run that query. It won't resolve all the attributes on top of
that query. You're telling it what IdPAttribute to resolve.</pre>
</blockquote>
<br>
Indeed, the attribute resolver was not actually Resolving all the
attributes, it was just the LDAP read was still returning them all.<br>
<br>
<blockquote cite="mid:0844f174-bcf1-4c2d-151c-ba24d32aa9fb@osu.edu"
type="cite">
<pre wrap="">Keep in mind that if the LDAP connector is caching, that's going to
cause problems getting it to re-resolve the data since it will just give
you back the same results.</pre>
</blockquote>
<br>
The entry cache I mentioned was part of our LDAP server itself, not
the IdP's LDAP code. Since it has direct access to the entry it
knows to invalidate results if the entry has been modified.<br>
<br>
We'll watch out for caching on the IdP side when we tackle LDAP
configuration tuning. So far it hasn't been a problem - it has
always picked up the change "immediately" (i.e. within a few
seconds). We're still mostly using defaults for LDAP tunables.<br>
<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>