<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Feb 17, 2025, at 2:21 PM, Michael Grady <mgrady@unicon.net> wrote:</div><br class="Apple-interchange-newline"><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Feb 17, 2025, at 2:01 PM, Cantor, Scott <cantor.2@osu.edu> wrote:</div><br class="Apple-interchange-newline"><div><div><blockquote type="cite">Is there some very basic thing I've done wrong? (This is with<br>v5.1.3, and its a RDB type DC.)<br></blockquote><br>I suspect in fact neither is working, for reasons too complex to explain [1], but in general the feature didn't work right in a lot of cases, and I would guess that's one such case.<br><br>But it's not going to be specific to part of the resolver, it's a problem in getting to the label when executing the condition and so the label is being ignored in many cases.<br><br>Fixed in 5.2.0.<br><br>-- Scott<br><br>[1] https://shibboleth.atlassian.net/browse/JSATTR-36<br><br></div></div></blockquote></div><div><br></div><div>Thanks! I'll use a metadata tag-based activation condition for now, until we get this one to 5.2.</div><div><br></div><div>
<div>--<br>Michael A. Grady<br></div></div></div></div></blockquote><br></div><div>One more somewhat related question on the value of <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">resolutionPhases (when 5.2 comes out). I know the value for that is set to </span><font color="#000000"><span style="caret-color: rgb(0, 0, 0);">"intercept/impersonate" when resolving attributes to be relied on in the impersonate flow, but will it also be set to that same value if the user chooses someone to impersonate, and attributes need to be "re-resolved" for that new userid?</span></font></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">I ask because I was wondering if one would want to potentially "not resolve" the main DC (complex DB query) if the resolutionPhase was </span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">"intercept/impersonate", and only run the impersonate-specific DC. But clearly if the re-resolve as a different user still was labelled as the </span><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">"intercept/impersonate" phase, one would not want to do that -- the main DV would most definitely still need to run during that phase.</span></div><br><div>
<div>--<br>Michael A. Grady<br>IAM Architect, Unicon, Inc.</div><div><br></div><br class="Apple-interchange-newline">
</div>
<br></body></html>