attributes are not getting released

[Ashok Kumar]

Hmm... If you are trying to find all the users along with all their
attributes & values, then you may try filter uid=* in data connector. I have
not used before from IdP but using ldapsearch on LDAP, it will give you all
the entries requested on a specific basedn.

What are you trying to achieve out of it?

On Tue, Aug 16, 2011 at 2:34 PM, Pavan K <pavanonnet1986 at gmail.com> wrote:

> Thank you Ashok and Chad. It was LDAP configruation issue. I gave the wrong
> filter parameter. It is working fine now.
>
> I have one more question, while configuring the LDAP connector we are
> forced to specify the "filterParameter". That is forcing us to get the
> attributes of a particular user. But is there any way to get the attributes
> of all the users that are present in LDAP hierarchy?
>
> Thank you,
> Naresh
>
>
> On Tue, Aug 16, 2011 at 2:25 PM, Ashok Kumar <ashok.kumar at csueastbay.edu>wrote:
>
>> What's the value of USERNAME? I mean USERNAME should have enough
>> privileges to get the value of $requestContext.principalName. Its kind of
>> service account for LDAP. You may try with cn="Directory Manager" if you
>> have the option.
>>
>> Do you see the value of $requestContext.principalName in logs? Its the
>> name of the user who is supposed to be authenticated.
>>
>> I see there is no value coming for uid from LDAP in the logs which is
>> $requestContext.principalName.
>>
>> Thanks,
>> -Ashok
>>
>>
>> On Tue, Aug 16, 2011 at 1:58 PM, Pavan K <pavanonnet1986 at gmail.com>wrote:
>>
>>> Here is my LDAP data connector configruation,
>>>
>>>
>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>>>         ldapURL="ldap://<IP_ADDRESS>:389"
>>>         baseDN="ou=public,dc=abc,dc=com"
>>>         principal="<USER_NAME>"
>>>         principalCredential="<PASSWORD>">
>>>         <dc:FilterTemplate>
>>>             <![CDATA[
>>>                 (uid=$requestContext.principalName)
>>>             ]]>
>>>         </dc:FilterTemplate>
>>>     </resolver:DataConnector>
>>>
>>>
>>> and here is the log
>>>
>>>
>>> 13:43:54.714 - DEBUG
>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308]
>>> - Search filter: (uid=<USERNAME>)
>>> 13:43:54.714 - DEBUG
>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363]
>>> - LDAP data connector myLDAP - Retrieving attributes from LDAP
>>> 13:43:54.714 - DEBUG
>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the
>>> following parameters:
>>> 13:43:54.714 - DEBUG
>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] -   authtype =
>>> simple
>>> 13:43:54.714 - DEBUG
>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   dn
>>> =<USERNAME>
>>> 13:43:54.714 - DEBUG
>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] -   credential
>>> = <suppressed>
>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with the
>>> following parameters:
>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:194] -   dn =
>>> ou=public,dc=abc,dc=com
>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:195] -   filter =
>>> (uid=<USERNAME>)
>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:196] -   filterArgs =
>>> []
>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:197] -   searchControls
>>> = javax.naming.directory.SearchControls at 1c28517
>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:198] -   handler =
>>> [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1afe460,
>>> edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler at ba8fce,
>>> edu.vt.middleware.ldap.handler.BinarySearchResultHandler at 3744bc]
>>> 13:43:54.730 - DEBUG
>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>> - Resolved attribute uid containing 0 values
>>> 13:43:54.730 - DEBUG
>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>> - Resolving attribute mail for principal <USERNAME>
>>> 13:43:54.730 - DEBUG
>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>> - Resolved attribute mail containing 0 values
>>> 13:43:54.730 - DEBUG
>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>> - Resolving attribute transientId for principal <USERNAME>
>>>
>>>
>>>
>>> On Tue, Aug 16, 2011 at 1:52 PM, Ashok Kumar <ashok.kumar at csueastbay.edu
>>> > wrote:
>>>
>>>> How is your LDAP Data connector entry looks like in resolver.conf file?
>>>>
>>>> Thanks,
>>>> -Ashok
>>>>
>>>>
>>>> On Tue, Aug 16, 2011 at 1:38 PM, Pavan K <pavanonnet1986 at gmail.com>wrote:
>>>>
>>>>> Thank you Ashok. IN the logs i am seeing the following messages,
>>>>>
>>>>> Resolved attribute uid containing 0 values
>>>>> 13:31:29.447 - DEBUG
>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>> - Resolving attribute mail for principal pavank
>>>>> 13:31:29.447 - DEBUG
>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>>>> - Resolved attribute mail containing 0 values
>>>>> 13:31:29.447 - DEBUG
>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>> - Resolving attribute transientId for principal pavank
>>>>>
>>>>> I did not understand why it is not getting the value from LDAP. Is
>>>>> there configuration i am missing?
>>>>>
>>>>> Thank you,
>>>>> Pavan
>>>>>
>>>>>
>>>>> On Tue, Aug 16, 2011 at 1:05 PM, Ashok Kumar <
>>>>> ashok.kumar at csueastbay.edu> wrote:
>>>>>
>>>>>> I think if you see the IdP access logs, it will tell you what
>>>>>> attribute has been resolved and what are filtered. You may need to set the
>>>>>> log level to debug to see all this.
>>>>>>
>>>>>> Thanks,
>>>>>> -Ashok
>>>>>>
>>>>>>
>>>>>> On Tue, Aug 16, 2011 at 12:42 PM, Pavan K <pavanonnet1986 at gmail.com>wrote:
>>>>>>
>>>>>>>  Hi All,
>>>>>>>
>>>>>>> I am new to Shibboleth identity provider. I have installed and
>>>>>>> configured the Shibboleth identity provider by following the instructions
>>>>>>> given in shibboleth home page. I configured LDAP data connector to retrieve
>>>>>>> some attributes. And when i test the attribute resolver by using "AACLI"
>>>>>>> tool i am getting "No attribute statement" all the time. I did not find any
>>>>>>> logs related to attribute retrieval in the log files.
>>>>>>>
>>>>>>> My configuration details as follows,
>>>>>>>
>>>>>>> *"handler.xml"*
>>>>>>>
>>>>>>> <ph:LoginHandler xsi:type="ph:UsernamePassword"
>>>>>>>
>>>>>>> jaasConfigurationLocation="file://IDP_HOME/conf/login.config">
>>>>>>>
>>>>>>> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
>>>>>>>     </ph:LoginHandler>
>>>>>>>
>>>>>>> *"login.config"*
>>>>>>>
>>>>>>> edu.vt.middleware.ldap.jaas.LdapLoginModule required
>>>>>>>       ldapUrl="LDAP_URL"
>>>>>>>       baseDn="ou=public,dc=abc,dc=com"
>>>>>>>       tls="true"
>>>>>>>       userFilter="uid={0}"
>>>>>>>    ;
>>>>>>>
>>>>>>> *"attribute-filter.xml"
>>>>>>>
>>>>>>> *<afp:AttributeFilterPolicy>
>>>>>>>         <afp:PolicyRequirementRule xsi:type="basic:ANY" />
>>>>>>>
>>>>>>>         <afp:AttributeRule attributeID="mail">
>>>>>>>             <afp:PermitValueRule xsi:type="basic:ANY" />
>>>>>>>         </afp:AttributeRule>
>>>>>>>     </afp:AttributeFilterPolicy>
>>>>>>>
>>>>>>> *"attribute-resolver.xml"
>>>>>>>
>>>>>>>
>>>>>>> * <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail"
>>>>>>> sourceAttributeID="mail">
>>>>>>>         <resolver:Dependency ref="myLDAP" />
>>>>>>>     <resolver:AttributeEncoder xsi:type="SAML2String"
>>>>>>>     xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>>>>>>>             name="urn:oid:0.9.2342.19200300.100.1.1"
>>>>>>> friendlyName="mail" />
>>>>>>>     </resolver:AttributeDefinition>
>>>>>>>
>>>>>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>>>>>>>         ldapURL="LDAP_URL"
>>>>>>>         baseDN="ou=public,dc=abc,dc=com"
>>>>>>>         principal="USER_NAME"
>>>>>>>         principalCredential="PASSWORD">
>>>>>>>         <dc:FilterTemplate>
>>>>>>>             <![CDATA[
>>>>>>>                 (uid=$requestContext.principalName)
>>>>>>>             ]]>
>>>>>>>         </dc:FilterTemplate>
>>>>>>>     </resolver:DataConnector>*
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> *Even when i comment the statements in "login.config" file, i am not
>>>>>>> getting any errors in the log file and still getting "No Aattribute
>>>>>>> Statement" message. Following is the command i am using from "IDP_HOME"
>>>>>>> *
>>>>>>>
>>>>>>> aacli.bat --configDir=../conf --principal=<USER_NAME>
>>>>>>>
>>>>>>> *Could anyone please help me get this working? Am i missing
>>>>>>> something in the configruation?
>>>>>>>
>>>>>>> Thank you in advance.
>>>>>>>
>>>>>>> -- Pavan
>>>>>>>
>>>>>>> --
>>>>>>> To unsubscribe from this list send an email to
>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> To unsubscribe from this list send an email to
>>>>>> users-unsubscribe at shibboleth.net
>>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> To unsubscribe from this list send an email to
>>>>> users-unsubscribe at shibboleth.net
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> To unsubscribe from this list send an email to
>>>> users-unsubscribe at shibboleth.net
>>>>
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>
>>
>>
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 





-Ashok Kumar
CSUEB
Email: ashok.kumar at csueastbay.edu
Phone: 510-885-2141
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20110816/73d14fd3/attachment.html