LDAP defaults

[Cantor, Scott]

On 10/1/15, 4:18 PM, "dev on behalf of Nate Klingenstein" <dev-bounces at shibboleth.net on behalf of ndk at internet2.edu> wrote:

>1)  Is there a reason why the attribute filter for resolution doesn’t depend on the authentication filter like the other properties do, and is there a difference between requestContext.principalName and {user}?  e.g.
>
>idp.authn.LDAP.bindDN                           = uid=myservice,ou=system
>idp.attribute.resolver.LDAP.bindDN              = %{idp.authn.LDAP.bindDN}
>
>…
>
>idp.authn.LDAP.userFilter                       = (uid={user})
>idp.attribute.resolver.LDAP.searchFilter        = (uid=$requestContext.principalName)

The value of requestContext.principalName (which I think we shouldn't be using, that's a V2 compatibility API thing, the modern equiv. is slightly different) is the product of the c14n step after login [1] that produces the "normalized" username so that the resolver doesn't have to be configured with multiple conventions for names like V2 does.

By definition there can't be any such value during the login process, that's too early. {user} is, I'm guessing, an ldaptive convention for building the search filter to contain the value for "username" passed into the API, which is what the user entered.

They do not have to be at all the same thing, that's why they're separate. In many cases they may end up the same.

-- Scott