attributes are not getting released
Chad La Joie
lajoie at itumi.biz
Tue Aug 16 22:49:32 BST 2011
Thats just going to cause an exception. The attribute resolver is
designed to provide information for a single user.
On Tue, Aug 16, 2011 at 17:45, Ashok Kumar <ashok.kumar at csueastbay.edu> wrote:
> Hmm... If you are trying to find all the users along with all their
> attributes & values, then you may try filter uid=* in data connector. I have
> not used before from IdP but using ldapsearch on LDAP, it will give you all
> the entries requested on a specific basedn.
>
> What are you trying to achieve out of it?
>
> On Tue, Aug 16, 2011 at 2:34 PM, Pavan K <pavanonnet1986 at gmail.com> wrote:
>>
>> Thank you Ashok and Chad. It was LDAP configruation issue. I gave the
>> wrong filter parameter. It is working fine now.
>>
>> I have one more question, while configuring the LDAP connector we are
>> forced to specify the "filterParameter". That is forcing us to get the
>> attributes of a particular user. But is there any way to get the attributes
>> of all the users that are present in LDAP hierarchy?
>>
>> Thank you,
>> Naresh
>>
>> On Tue, Aug 16, 2011 at 2:25 PM, Ashok Kumar <ashok.kumar at csueastbay.edu>
>> wrote:
>>>
>>> What's the value of USERNAME? I mean USERNAME should have enough
>>> privileges to get the value of $requestContext.principalName. Its kind of
>>> service account for LDAP. You may try with cn="Directory Manager" if you
>>> have the option.
>>>
>>> Do you see the value of $requestContext.principalName in logs? Its the
>>> name of the user who is supposed to be authenticated.
>>>
>>> I see there is no value coming for uid from LDAP in the logs which is
>>> $requestContext.principalName.
>>>
>>> Thanks,
>>> -Ashok
>>>
>>>
>>> On Tue, Aug 16, 2011 at 1:58 PM, Pavan K <pavanonnet1986 at gmail.com>
>>> wrote:
>>>>
>>>> Here is my LDAP data connector configruation,
>>>>
>>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>>>> ldapURL="ldap://<IP_ADDRESS>:389"
>>>> baseDN="ou=public,dc=abc,dc=com"
>>>> principal="<USER_NAME>"
>>>> principalCredential="<PASSWORD>">
>>>> <dc:FilterTemplate>
>>>> <![CDATA[
>>>> (uid=$requestContext.principalName)
>>>> ]]>
>>>> </dc:FilterTemplate>
>>>> </resolver:DataConnector>
>>>>
>>>>
>>>> and here is the log
>>>>
>>>>
>>>> 13:43:54.714 - DEBUG
>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308]
>>>> - Search filter: (uid=<USERNAME>)
>>>> 13:43:54.714 - DEBUG
>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363]
>>>> - LDAP data connector myLDAP - Retrieving attributes from LDAP
>>>> 13:43:54.714 - DEBUG
>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the
>>>> following parameters:
>>>> 13:43:54.714 - DEBUG
>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - authtype =
>>>> simple
>>>> 13:43:54.714 - DEBUG
>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - dn
>>>> =<USERNAME>
>>>> 13:43:54.714 - DEBUG
>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] - credential
>>>> = <suppressed>
>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with the
>>>> following parameters:
>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:194] - dn =
>>>> ou=public,dc=abc,dc=com
>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:195] - filter =
>>>> (uid=<USERNAME>)
>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:196] - filterArgs =
>>>> []
>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:197] -
>>>> searchControls = javax.naming.directory.SearchControls at 1c28517
>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:198] - handler =
>>>> [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1afe460,
>>>> edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler at ba8fce,
>>>> edu.vt.middleware.ldap.handler.BinarySearchResultHandler at 3744bc]
>>>> 13:43:54.730 - DEBUG
>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>>> - Resolved attribute uid containing 0 values
>>>> 13:43:54.730 - DEBUG
>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>> - Resolving attribute mail for principal <USERNAME>
>>>> 13:43:54.730 - DEBUG
>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>>> - Resolved attribute mail containing 0 values
>>>> 13:43:54.730 - DEBUG
>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>> - Resolving attribute transientId for principal <USERNAME>
>>>>
>>>>
>>>> On Tue, Aug 16, 2011 at 1:52 PM, Ashok Kumar
>>>> <ashok.kumar at csueastbay.edu> wrote:
>>>>>
>>>>> How is your LDAP Data connector entry looks like in resolver.conf file?
>>>>>
>>>>> Thanks,
>>>>> -Ashok
>>>>>
>>>>> On Tue, Aug 16, 2011 at 1:38 PM, Pavan K <pavanonnet1986 at gmail.com>
>>>>> wrote:
>>>>>>
>>>>>> Thank you Ashok. IN the logs i am seeing the following messages,
>>>>>>
>>>>>> Resolved attribute uid containing 0 values
>>>>>> 13:31:29.447 - DEBUG
>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>>> - Resolving attribute mail for principal pavank
>>>>>> 13:31:29.447 - DEBUG
>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>>>>> - Resolved attribute mail containing 0 values
>>>>>> 13:31:29.447 - DEBUG
>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>>> - Resolving attribute transientId for principal pavank
>>>>>>
>>>>>> I did not understand why it is not getting the value from LDAP. Is
>>>>>> there configuration i am missing?
>>>>>>
>>>>>> Thank you,
>>>>>> Pavan
>>>>>>
>>>>>> On Tue, Aug 16, 2011 at 1:05 PM, Ashok Kumar
>>>>>> <ashok.kumar at csueastbay.edu> wrote:
>>>>>>>
>>>>>>> I think if you see the IdP access logs, it will tell you what
>>>>>>> attribute has been resolved and what are filtered. You may need to set the
>>>>>>> log level to debug to see all this.
>>>>>>>
>>>>>>> Thanks,
>>>>>>> -Ashok
>>>>>>>
>>>>>>>
>>>>>>> On Tue, Aug 16, 2011 at 12:42 PM, Pavan K <pavanonnet1986 at gmail.com>
>>>>>>> wrote:
>>>>>>>>
>>>>>>>> Hi All,
>>>>>>>>
>>>>>>>> I am new to Shibboleth identity provider. I have installed and
>>>>>>>> configured the Shibboleth identity provider by following the instructions
>>>>>>>> given in shibboleth home page. I configured LDAP data connector to retrieve
>>>>>>>> some attributes. And when i test the attribute resolver by using "AACLI"
>>>>>>>> tool i am getting "No attribute statement" all the time. I did not find any
>>>>>>>> logs related to attribute retrieval in the log files.
>>>>>>>>
>>>>>>>> My configuration details as follows,
>>>>>>>>
>>>>>>>> "handler.xml"
>>>>>>>>
>>>>>>>> <ph:LoginHandler xsi:type="ph:UsernamePassword"
>>>>>>>>
>>>>>>>> jaasConfigurationLocation="file://IDP_HOME/conf/login.config">
>>>>>>>>
>>>>>>>> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
>>>>>>>> </ph:LoginHandler>
>>>>>>>>
>>>>>>>> "login.config"
>>>>>>>>
>>>>>>>> edu.vt.middleware.ldap.jaas.LdapLoginModule required
>>>>>>>> ldapUrl="LDAP_URL"
>>>>>>>> baseDn="ou=public,dc=abc,dc=com"
>>>>>>>> tls="true"
>>>>>>>> userFilter="uid={0}"
>>>>>>>> ;
>>>>>>>>
>>>>>>>> "attribute-filter.xml"
>>>>>>>>
>>>>>>>> <afp:AttributeFilterPolicy>
>>>>>>>> <afp:PolicyRequirementRule xsi:type="basic:ANY" />
>>>>>>>>
>>>>>>>> <afp:AttributeRule attributeID="mail">
>>>>>>>> <afp:PermitValueRule xsi:type="basic:ANY" />
>>>>>>>> </afp:AttributeRule>
>>>>>>>> </afp:AttributeFilterPolicy>
>>>>>>>>
>>>>>>>> "attribute-resolver.xml"
>>>>>>>>
>>>>>>>>
>>>>>>>> <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail"
>>>>>>>> sourceAttributeID="mail">
>>>>>>>> <resolver:Dependency ref="myLDAP" />
>>>>>>>> <resolver:AttributeEncoder xsi:type="SAML2String"
>>>>>>>> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>>>>>>>> name="urn:oid:0.9.2342.19200300.100.1.1"
>>>>>>>> friendlyName="mail" />
>>>>>>>> </resolver:AttributeDefinition>
>>>>>>>>
>>>>>>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>>>>>>>> ldapURL="LDAP_URL"
>>>>>>>> baseDN="ou=public,dc=abc,dc=com"
>>>>>>>> principal="USER_NAME"
>>>>>>>> principalCredential="PASSWORD">
>>>>>>>> <dc:FilterTemplate>
>>>>>>>> <![CDATA[
>>>>>>>> (uid=$requestContext.principalName)
>>>>>>>> ]]>
>>>>>>>> </dc:FilterTemplate>
>>>>>>>> </resolver:DataConnector>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> Even when i comment the statements in "login.config" file, i am not
>>>>>>>> getting any errors in the log file and still getting "No Aattribute
>>>>>>>> Statement" message. Following is the command i am using from "IDP_HOME"
>>>>>>>>
>>>>>>>> aacli.bat --configDir=../conf --principal=<USER_NAME>
>>>>>>>>
>>>>>>>> Could anyone please help me get this working? Am i missing something
>>>>>>>> in the configruation?
>>>>>>>>
>>>>>>>> Thank you in advance.
>>>>>>>>
>>>>>>>> -- Pavan
>>>>>>>>
>>>>>>>> --
>>>>>>>> To unsubscribe from this list send an email to
>>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> To unsubscribe from this list send an email to
>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>
>>>>>>
>>>>>> --
>>>>>> To unsubscribe from this list send an email to
>>>>>> users-unsubscribe at shibboleth.net
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> To unsubscribe from this list send an email to
>>>>> users-unsubscribe at shibboleth.net
>>>>
>>>>
>>>> --
>>>> To unsubscribe from this list send an email to
>>>> users-unsubscribe at shibboleth.net
>>>
>>>
>>>
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
>
> --
>
>
>
>
>
> -Ashok Kumar
> CSUEB
> Email: ashok.kumar at csueastbay.edu
> Phone: 510-885-2141
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
--
Chad La Joie
www.itumi.biz
trusted identities, delivered
More information about the users
mailing list