The Shibboleth IdP V3 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP4 wiki space for current documentation on the supported version.

Dependency

Owned by Rod Widdowson
Last updated: Mar 19, 2018 by Philip PishioneriVersion comment
2 min read

Note that this element is deprecated in V3.4, replaced by the InputAttributeDefinition and InputDataConnector elements

Overview

This element defines an input (note: not a dependency) to the containing attribute definition or data connector.

This elements is defined by the urn:mace:shibboleth:2.0:resolver schema, which is located at http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd.

Attribute

Name
Type
Description

ref

String

This is the identifier of an Attribute Definition or Data Connector

Semantics

The precise semantics of this attribute depend on the type of plugin (data connector or attribute definition) to which it refers, as well as the type of the enclosing data connector or attribute definition

Multi-Attribute Definitions

Multi-input definitions refers to Attribute Definitions or Data Connectors which consume multiple attributes. The current supported definitions are:

In this case:

  • If the reference is to an Attribute Definition, then the attribute and all its values are made available to the enclosing definition.  If an attribute of the same name has already been provided, then the values are combined,
  • If the reference is to a Data Connector then all the attributes that it defines are made available to the enclosing definition.  If any attribute of the same name has already been provided, then the values are combined,

Multi-Value Definitions

Multi-value definitions refers to Attribute Definitions or Data Connectors which consume attribute values.  These values are often, but not always from one definition. Nearly all attribute definitions are multi-value.  The deprecated ComputerdIdConnector is a degenerate Multi-Value Definition in that it requires a single value (which may come from multiple sources, all but one of which would be empty).

In this case:

  • If the reference is to an Attribute Definition, then all the attribute values are made available.  Values from multiple attributes are combined.
  • If the reference is to a Data Connector then the sourceAttributeID is used to select a single attribute whose values are made available.
  • If the reference is to a Data Connector then it is an error to not specify the sourceAttributeID.

Deprecated 3.4

In V3.4 this is deprecated and replaced by InputDataConnector and InputAttributeDefinition.

It is easy to mechanically convert a <Dependency> into a <InputDataConnector> or a <InputAttributeDefinition>

  • If the referenced item is an attribute definition, just change <Dependency> into <InputAttributeDefinition>
  • If the referenced item is a data connector:
    1. Change the <Dependency> into a <InputDataConnector>
    2. If the enclosing definition is a multi-value definition there will be a sourceAttributeID provided.  Use the value as the value to an attributeNames= in the <InputDataConnector>
    3. If the enclosing definition is multi-attribute add the attribute allAttributes="true",
  • When all <Dependency>  elements have been removed from a definition the sourceAttributeID attribute can be removed.