Shibboleth Developers

[Chad La Joie <>]

Walter asked me if I'd take a look at bug 308

http://bugzilla.internet2.edu/show_bug.cgi?id=308

When I initially looked at it I understood what Rob wanted but was 
worried about unexpected side effects.  Since data connectors return a 
set of name:value(s) structures which belong to a single entity (the 
principal).  One way (the only way?) to return the same sort of data 
structure where multiple results were returned would be to union the 
attributes from each result and their values.  So, if you had a result 
with attribute foo and value bar, and a result with attribute foo with a 
value baz, the result of the attribute resolution would have an 
attribute foo with values bar and baz.

In the specific case that Rob cites this is probably exactly what you 
want; the IDs of all the groups that come back from a query inspecting 
group membership.  However, my concern was that in some cases this is 
probably a really bad idea.  If, for some reason, you were searching for 
person entries and got back more than one, you probably DON'T want a 
union of the attributes and values.  So my thought is to simply have an 
attribute on the connector configuration element in the resolver config. 
 Turn it on, attributes/values get unioned, turn it off (default) you 
get an error.  Then you'd define something like a connector for people, 
with attribute unioning turned off, and a connector for groups with it 
turned on.

Does this sound reasonable?
--
Chad La Joie             315Q St. Mary's Hall
Project Sentinel         202.687.0124