This element is available in V3.4 and later of the software.

Overview

This element defines a data connector as being input to the containing AttributeDefinition or DataConnector.

This element is defined by the urn:mace:shibboleth:2.0:resolver schema, which is located at http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd.

Attributes

Name	Type	Description
ref	String	This is the identifier of an D ata Connector
`attributeNames`	Space-delimited list	These are the attributes which are to form the input (a single name can also be specified). Mutually exclusive to allAttributes
`allAttributes`	boolean	If present and has value true indicates that all attributes should be supplied as input. Mutually exclusive to attributeNames

Semantics

The precise semantics of this element depend on the type of the enclosing Attribute Definition or Data Connector.

Multi-Attribute Definitions

Multi-attribute definitions refers to Attribute Definitions or Data Connectors which consume multiple attributes. The current supported definitions are:

The Scripted DataConnector and AttributeDefinition.
The Template AttributeDefinition.
The RDBMS and LDAP DataConnectors.

In this case all the detailed attributes are made available to the enclosing definition. If an attribute of the same name has already been provided, then the values are combined.

Multi-Value Definitions

Multi-value definitions refers to Attribute Definitions or Data Connectors which consume attribute values. These values are often, but not always, from one definition. Nearly all attribute definitions are multi-value. The deprecated ComputedIdConnector is a degenerate Multi-Value Definition in that it requires a single value (which may come from multiple sources, all but one of which would be empty).

In this case all the attribute values of all the detailed attributes are made available. Values from multiple attributes are combined. In this situation it is usual to only specify one attribute to attributeNames, but this is by no means required and so this mechanism can be used to combine the values from multiple attributes from the same data connector into one output attribute.

Examples

The following attribute definition combines the attribute values from four attributes from three input sources. After this runs the output attribute "MultiIn" will contain:

All the values from the attribute definition 'attribute1'
All the values from the attributes 'attribute2' and 'attribute3' sourced from the data connector 'connector1'
All the values from the attributes 'attribute4' sourced from the data connector 'connector2'

This is because Simple attribute definitions are multi-value definitions

<AttributeDefinition id="MultiIn" xsi:type="Simple"> 
    <InputAttributeDefinition ref="attribute1"/>
    <InputDataConnector ref="connector1" attributeNames="attribute2 attribute3" />
    <InputDataConnector ref="connector2" attributeNames="attribute4" />
</AttributeDefinition>

The following attribute definition shows how to provide multiple input attributes to a Scripted Attribute Definition. When this runs the definition will have access to four attributes:

An attribute called 'attribute1' (with values from that attribute definition)
Attributes called 'attribute2' and 'attribute3' with values sourced from the attributes of those names in data connector 'connector1'
An attribute called 'attribute4' with values sourced from the data connector 'connector2'

This is because Scripted attribute definitions are multi-attribute definitions

<AttributeDefinition id="Scripted" xsi:type="Scripted"> 
    <InputAttributeDefinition ref="attribute1"/>
    <InputDataConnector ref="connector1" attributeNames="attribute2 attribute3" />
    <InputDataConnector ref="connector2" attributeNames="attribute4" />
</AttributeDefinition>

In the following definition all the attributes from data connector DC1 are made available to the definition

<AttributeDefinition id="Scripted" xsi:type="Scripted">
    <InputDataConnector ref="DC1" allAttributes="true" />
</AttributeDefinition>