Shibboleth Developers

[Walter Hoehn <>]

This pretty much describes what I had been thinking.  Thanks for 
looking into this...

-Walter


On May 17, 2005, at 6:30 PM, Chad La Joie wrote:

> Walter asked me if I'd take a look at bug 308
>
> http://bugzilla.internet2.edu/show_bug.cgi?id=308
>
> When I initially looked at it I understood what Rob wanted but was 
> worried about unexpected side effects.  Since data connectors return a 
> set of name:value(s) structures which belong to a single entity (the 
> principal).  One way (the only way?) to return the same sort of data 
> structure where multiple results were returned would be to union the 
> attributes from each result and their values.  So, if you had a result 
> with attribute foo and value bar, and a result with attribute foo with 
> a value baz, the result of the attribute resolution would have an 
> attribute foo with values bar and baz.
>
> In the specific case that Rob cites this is probably exactly what you 
> want; the IDs of all the groups that come back from a query inspecting 
> group membership.  However, my concern was that in some cases this is 
> probably a really bad idea.  If, for some reason, you were searching 
> for person entries and got back more than one, you probably DON'T want 
> a union of the attributes and values.  So my thought is to simply have 
> an attribute on the connector configuration element in the resolver 
> config.  Turn it on, attributes/values get unioned, turn it off 
> (default) you get an error.  Then you'd define something like a 
> connector for people, with attribute unioning turned off, and a 
> connector for groups with it turned on.
>
> Does this sound reasonable?
> --
> Chad La Joie             315Q St. Mary's Hall
> Project Sentinel         202.687.0124