Re: [Unity-idm-discuss] Output translation profile is too talkative

[Krzysztof B. <kb...@un...>]

Hi Sander,


W dniu 20.03.2017 o 09:33, Sander Apweiler pisze:
> Hi Krzysztof, all,
>
> I'm redesigning our output translation profiles. Therefore I start with
> new translation profile with small information. I want to reduce the
> output for users in confirmation screen. My output translation profile
> (whole profile below) has only four rules, but the confirmation screen
> lists eight attributes. Some of them are not requested and not released
> by translation profile. So is there a mix up with default output
> translation profile? If yes, is it possible to avoid this mix up?

As you can read in output profile documentation:

'Output translation profile operates on a data structure which is 
initially filled by Unity with all attributes and identities of the 
queried principal. Attributes are from the group configured in the 
endpoint.'

The default profile merely adds dynamic memberOf attribute which is 
commonly requested. All of this happens as we want to have the most 
sensible defaults without any output profile.


If you want to have a full control over all attributes using your output 
profile start it from filtering rules. E.g. to filter all attributes use 
the filterAttribute with .* argument. You can then either "un-hide" 
selected attribute or release all dynamic ones using createAttribute rule.

Cheers,
KB