The Shibboleth IdP V4 software has reached its End of Life and is no longer supported. This documentation is available for historical purposes only. See the IDP5 wiki space for current documentation on the supported version.

SubjectDataConnector

Owned by Scott Cantor
Last updated: Nov 09, 2021
1 min read

Namespace: urn:mace:shibboleth:2.0:resolver
Schema: http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd

Overview

The Subject DataConnector exposes IdPAttribute objects contained within Java Subject(s). It examines Subject(s) and extracts all IdPAttributePrincipal custom principal objects and their wrapped IdPAttribute objects and directly exposes them as the outputs of the connector.

The primary use case for this connector is dealing with the results of external/proxied authentication sources that pass attribute data into the IdP. It can operate in a couple of different modes, either operating against Subjects produced as a result of authentication, or against a Subject undergoing SubjectCanonicalization for use in deriving a principal name.

This is a more streamlined "bulk" alternative to the SubjectDerivedAttribute attribute definition, which can extract only a single attribute at a time. Via the new exporting feature, this connector can expose all of the data at once as a passthrough to support proxying of data.

Reference

Name

Type

Default

Description

Name

Type

Default

Description

noResultIsError

Boolean

false

Controls whether the extraction of no data constitutes a resolution error, which can trigger failover or fail the resolution outright

forCanonicalization

Boolean

false

If true, a Subject undergoing SubjectCanonicalization is used as input rather than the default of looking for previously completed authentication results

Example

<DataConnector id="passthroughAttributes" xsi:type="Subject" exportAttributes="foo bar baz" />

Â