Please refrain from running ac_factory if not explicitly asked for

I’ve been struggling with satosa failing internal atrribute mapping because pysaml2 had converted my incoming long SAML urn based attributes to shortnames before any custom attribute mapping was applied. This caused unexpected behaviour because I expected the internal mapping to be able to operate on original received long urn format attributes but was forced to map shortnames to internal representation instead. This is unexpected, non standard behaviour and should preferably be disabled unless explicitly requested by config parameter like e.g. use_ac_factory_map.

I fixed the problem by inserting a acs = [] just before _acs = self.getattr("attribute_converters", typ) in config.py@277 to simply circumvent the “No attribute converters” exception above.

[jkakavas]

I see your point. For the time being, you can set the configuration option attribute_map_dir to an empty directory in order to produce an empty acs ( instead of overriding the code in config.py ).

The use of internal representations have been a conscious decision from @rohe AFAIK, but I would think that nothing breaks when no attribute maps are provided. ( Assuming the deployer knows that and i.e. filters on urn:oid values and/or uses these values in other software such as satosa ) . That would surely break some of our tests but we need to look into it.

I would suggest that we add a configuration parameter that allows for no attribute mapping instead of the “ugly hack” of providing an empty directory, PR’s are welcome.

[c00kiemon5ter]

I am closing this, as it is tracked by #549