<div dir="ltr"><div><br></div><div><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 23 April 2014 17:06, Daniel Fisher <span dir="ltr"><<a href="mailto:dfisher@vt.edu" target="_blank">dfisher@vt.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">On Wed, Apr 23, 2014 at 9:14 AM, Vasile Alin <<a href="mailto:alinachegalati@gmail.com">alinachegalati@gmail.com</a>> wrote:<br>
> This is the scenario:<br>
><br>
> The user logs in using an email address. We have a problem with special<br>
> characters in email addresses in our LDAP server so we want to translate<br>
> transparently the email address to another field, such as uid. This will be<br>
> done by changing the JAAS context with the associated uid and use it in the<br>
> actual LDAP bind.<br>
><br>
<br>
That is the default behavior of the LDAP JAAS module.<br>
<br>
ShibUserPassAuth {<br>
edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
ldapUrl="ldap://<a href="http://my.ldap.org" target="_blank">my.ldap.org</a>"<br>
baseDn="ou=people,dc=example,dc=org"<br>
userFilter="mail={0}"<br>
;<br>
};<br>
<br>
This will resolve the user's entry DN using the mail attribute and<br>
then bind as that entry.<br></blockquote><div><br></div><div><br></div><div>Correct, this is what we had so far.<br></div><div><br></div><div>Right now we still have the mail from the user but the bind has to be done using uid. Something like this:</div>
<div><br></div><div><span style="font-family:arial,sans-serif;font-size:13px">ShibUserPassAuth {</span><br style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial,sans-serif;font-size:13px"> edu.vt.middleware.ldap.jaas.</span><span style="font-family:arial,sans-serif;font-size:13px">LdapLoginModule required</span><br style="font-family:arial,sans-serif;font-size:13px">
<span style="font-family:arial,sans-serif;font-size:13px"> ldapUrl="ldap://</span><a href="http://my.ldap.org/" target="_blank" style="font-family:arial,sans-serif;font-size:13px">my.ldap.org</a><span style="font-family:arial,sans-serif;font-size:13px">"</span><br style="font-family:arial,sans-serif;font-size:13px">
<span style="font-family:arial,sans-serif;font-size:13px"> baseDn="ou=people,dc=example,</span><span style="font-family:arial,sans-serif;font-size:13px">dc=org"</span><br style="font-family:arial,sans-serif;font-size:13px">
<span style="font-family:arial,sans-serif;font-size:13px"> userFilter="uid={0}"</span><br style="font-family:arial,sans-serif;font-size:13px"><span style="font-family:arial,sans-serif;font-size:13px"> ;</span><br style="font-family:arial,sans-serif;font-size:13px">
<span style="font-family:arial,sans-serif;font-size:13px">};</span><br></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">The aim is to transform the mail into uid, so that the user's DN is resolved using that uid.</span></div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<span class=""><font color="#888888"><br>
--Daniel Fisher<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div></div>