SubjectDataConnector

Namespace: urn:mace:shibboleth:2.0:resolver
Schema: http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd

1 Overview
2 Reference
3 Example

Overview

The Subject DataConnector exposes IdPAttribute objects contained within Java Subject(s). It examines Subject(s) and extracts all IdPAttributePrincipal custom principal objects and their wrapped IdPAttribute objects and directly exposes them as the outputs of the connector.

The primary use case for this connector is dealing with the results of external/proxied authentication sources that pass attribute data into the IdP. It can operate in a couple of different modes, either operating against Subjects produced as a result of authentication, or against a Subject undergoing SubjectCanonicalization for use in deriving a principal name.

This is a more streamlined "bulk" alternative to the SubjectDerivedAttribute attribute definition, which can extract only a single attribute at a time. Via the new exporting feature, this connector can expose all of the data at once as a passthrough to support proxying of data.

Reference

Name	Type	Default	Description

Name	Type	Default	Description
noResultIsError	Boolean	false	Controls whether the extraction of no data constitutes a resolution error, which can trigger failover or fail the resolution outright
forCanonicalization	Boolean	false	If true, a Subject undergoing SubjectCanonicalization is used as input rather than the default of looking for previously completed authentication results

Name	Type	Default	Description

Name	Type	Default	Description
id	String		Identifier for the DataConnector. This is used for logging, to establish dependencies, and as a target for failover.
activationConditionRef	Bean ID		Bean ID of a condition to decide whether to resolve this connector, see here. Mutually exclusive with `relyingParties` and `resolutionPhases` and variants
relyingParties	Space-delimited list		List of entity IDs for which this connector should be resolved. Mutually exclusive with `activationConditionRef`
excludeRelyingParties	Space-delimited list		List of entity IDs for which this connector should not be resolved. Mutually exclusive with `activationConditionRef`
resolutionPhases	Space-delimited list		List of resolution phases (i.e. flows) during which this connector should be resolved. Mutually exclusive with `activationConditionRef`
excludeResolutionPhases	Space-delimited list		List of resolution phases (i.e. flows) during which this connector should not be resolved. Mutually exclusive with `activationConditionRef`
exportAttributes	Space-delimited list		List of attributes produced by the DataConnector that should be directly exported as resolved IdPAttributes without requiring actual AttributeDefinitions. In the case of a name clash (a DataConnector exports an attribute with the same name as an AttributeDefinition, or another DataConnector exports the same attribute) the DataConnector attribute is NOT added and a warning issued.
noRetryDelay	Duration	0	Time between retries of a failed DataConnector (during the interval, failure is just assumed when the connector is run and no actual connection is attempted)
propagateResolutionExceptions	Boolean	true	Whether connector/plugin failure is fatal to the entire attribute resolution process. If this is set to false the error is logged and the data connector returns no attributes.

This connector supports the <FailoverDataConnector> element (see DataConnectorConfiguration) but not dependencies.

Example

<DataConnector id="passthroughAttributes" xsi:type="Subject" exportAttributes="foo bar baz" />