<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4289">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: What should happen when you have 2 DataConnectors and 1 fails</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Dan,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">You're correct that attribute resolution occurs for all attributes each time, not just for the attributes being released in a given transaction. This is because attributes can depend on other attributes, other parts of the IdP can depend on attributes, and so forth.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">I don't know off the top of my head if there's a way to change the failure behavior. An elegant solution in your case may be using the new relyingParties setting on the groups connector so that it's only called when answering requests from services where the data will be needed.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Hope this helps and you may get a more complete answer from someone else,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Nate.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><blockquote style="border-left:2px solid #b0b0b7; margin-left:5px; margin-right:0px; padding-left:5px">-----Original message-----<br /><strong>From:</strong> Dan Malone<br /><strong>Sent:</strong> Friday, October 26 2018, 2:47 pm<br /><strong>To:</strong> Shib Users<br /><strong>Subject:</strong> What should happen when you have 2 DataConnectors and 1 fails<br /><br /><!-- begin sanitized html --><div style="background-color:#ffffff; color:#000000" class="bodyclass">Here's the scenario.<br />We have 2 LDAPDirectory DataConnectors, one pointing to our LDAP directory for all attributes except groups and the second pointing to Active Directory just to get groups (config snippet below). Groups is new to our configuration, so we only have one service that the group attribute is released to. Authentication is only against our LDAP directory.<br /><br />We had an issue yesterday where the Active Directory DC we were connected to was rebooted unexpectedly. This resulted in the following error:<blockquote><pre>2018-10-25 09:11:39,925 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:299] - Profile Action ResolveAttributes: Error resolving attributes
net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'myAD': Unable to execute LDAP search
...
</pre></blockquote> And users were receiving odd errors from all SAML and CAS integrated services and did not successfully authenticate to these services. None of these services in question have the group attribute released.<br /><br />My assumption based on these results is that attribute resolution is occurring for <strong>all</strong> attributes every time, not just for the needed attributes.<br /><br />Is this the expected behavior?<br />Is there a way to configure our AD DataConnector to fail more gracefully?<br />e.g. unable to connect or unable to search is equivalent to no attributes returned.<br /><br />From attribute-resolver.xml:<blockquote> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br /> ldapURL="@idp.ent.ldap.url@" baseDN="@idp.ent.ldap.baseDN@"<br /> principal="@idp.ent.ldap.principal@"<br /> principalCredential="@idp.ent.ldap.credential@"><br /> <dc:FilterTemplate><br /> <![CDATA[<br /> (|(mail=$requestContext.principalName)(<a title="This external link opens in a new window" class="moz-txt-link-abbreviated" href="mailto:mail=$requestContext.principalName@calpoly.edu">mail=$requestContext.principalName@calpoly.edu</a>))<br /> ]]><br /> </dc:FilterTemplate><br /> </resolver:DataConnector><br /><br /> <resolver:DataConnector id="myAD" xsi:type="dc:LDAPDirectory"<br /> ldapURL="@idp.ent.ad.url@" baseDN="@idp.ent.ad.baseDN@"<br /> principal="@idp.ent.ad.principal@"<br /> principalCredential="@idp.ent.ad.credential@"><br /> <dc:FilterTemplate><br /> <![CDATA[<br /> (|(sAMAccountName=$requestContext.principalName)(userPrincipalName=$requestContext.principalName))<br /> ]]><br /> </dc:FilterTemplate><br /> </resolver:DataConnector></blockquote><br />Thanks,<br />Dan<br /> <div class="moz-signature">--<br />Dan Malone<br />Lead Identity Management Architect<br />Information Technology Services<br />California Polytechnic State University<br />San Luis Obispo, California<br /><br />Direct 805-756-6326<br /><a title="This external link opens in a new window" class="moz-txt-link-abbreviated" href="mailto:dmalone@calpoly.edu">dmalone@calpoly.edu</a></div></div><pre>--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</pre> <!-- end sanitized html --></blockquote>
</body>
</html>