attributes are not getting released

Chad La Joie lajoie at itumi.biz
Tue Aug 16 23:09:58 BST 2011 

No.  The IdP is not a provisioning system.

On Tue, Aug 16, 2011 at 18:00, Pavan K <pavanonnet1986 at gmail.com> wrote:
> I don't want to deal with the database dump. I cannot do that in customer
> environment. Is there any possibility in Shibboleth IDP?
>
> Thank you,
> Naresh
>
> On Tue, Aug 16, 2011 at 2:57 PM, Ashok Kumar <ashok.kumar at csueastbay.edu>
> wrote:
>>
>>
>> On Tue, Aug 16, 2011 at 2:54 PM, Pavan K <pavanonnet1986 at gmail.com> wrote:
>>>
>>> Thank you Ashok.
>>>
>>> I want to populate all the users from LDAP for a given basedn in my
>>> application.
>>
>> I would suggest to take a ldif dump from LDAP for a given basedn and dump
>> in your application database.
>>
>>>
>>> I tried to use "*" for filter but it did not work. It is throwing "size
>>> limit exceeded" exception.
>>>
>>> javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit
>>> Exceeded]
>>>     at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
>>> ~[na:1.6.0_06]
>>>     at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
>>> ~[na:1.6.0_06]
>>>     at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
>>> ~[na:1.6.0_06]
>>>
>>>
>>> On Tue, Aug 16, 2011 at 2:45 PM, Ashok Kumar <ashok.kumar at csueastbay.edu>
>>> wrote:
>>>>
>>>> Hmm... If you are trying to find all the users along with all their
>>>> attributes & values, then you may try filter uid=* in data connector. I have
>>>> not used before from IdP but using ldapsearch on LDAP, it will give you all
>>>> the entries requested on a specific basedn.
>>>>
>>>> What are you trying to achieve out of it?
>>>>
>>>> On Tue, Aug 16, 2011 at 2:34 PM, Pavan K <pavanonnet1986 at gmail.com>
>>>> wrote:
>>>>>
>>>>> Thank you Ashok and Chad. It was LDAP configruation issue. I gave the
>>>>> wrong filter parameter. It is working fine now.
>>>>>
>>>>> I have one more question, while configuring the LDAP connector we are
>>>>> forced to specify the "filterParameter". That is forcing us to get the
>>>>> attributes of a particular user. But is there any way to get the attributes
>>>>> of all the users that are present in LDAP hierarchy?
>>>>>
>>>>> Thank you,
>>>>> Naresh
>>>>>
>>>>> On Tue, Aug 16, 2011 at 2:25 PM, Ashok Kumar
>>>>> <ashok.kumar at csueastbay.edu> wrote:
>>>>>>
>>>>>> What's the value of USERNAME? I mean USERNAME should have enough
>>>>>> privileges to get the value of $requestContext.principalName. Its kind of
>>>>>> service account for LDAP. You may try with cn="Directory Manager" if you
>>>>>> have the option.
>>>>>>
>>>>>> Do you see the value of $requestContext.principalName in logs? Its the
>>>>>> name of the user who is supposed to be authenticated.
>>>>>>
>>>>>> I see there is no value coming for uid from LDAP in the logs which is
>>>>>> $requestContext.principalName.
>>>>>>
>>>>>> Thanks,
>>>>>> -Ashok
>>>>>>
>>>>>>
>>>>>> On Tue, Aug 16, 2011 at 1:58 PM, Pavan K <pavanonnet1986 at gmail.com>
>>>>>> wrote:
>>>>>>>
>>>>>>> Here is my LDAP data connector configruation,
>>>>>>>
>>>>>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>>>>>>>         ldapURL="ldap://<IP_ADDRESS>:389"
>>>>>>>         baseDN="ou=public,dc=abc,dc=com"
>>>>>>>         principal="<USER_NAME>"
>>>>>>>         principalCredential="<PASSWORD>">
>>>>>>>         <dc:FilterTemplate>
>>>>>>>             <![CDATA[
>>>>>>>                 (uid=$requestContext.principalName)
>>>>>>>             ]]>
>>>>>>>         </dc:FilterTemplate>
>>>>>>>     </resolver:DataConnector>
>>>>>>>
>>>>>>>
>>>>>>> and here is the log
>>>>>>>
>>>>>>>
>>>>>>> 13:43:54.714 - DEBUG
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308]
>>>>>>> - Search filter: (uid=<USERNAME>)
>>>>>>> 13:43:54.714 - DEBUG
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363]
>>>>>>> - LDAP data connector myLDAP - Retrieving attributes from LDAP
>>>>>>> 13:43:54.714 - DEBUG
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the
>>>>>>> following parameters:
>>>>>>> 13:43:54.714 - DEBUG
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] -   authtype =
>>>>>>> simple
>>>>>>> 13:43:54.714 - DEBUG
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   dn
>>>>>>> =<USERNAME>
>>>>>>> 13:43:54.714 - DEBUG
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] -   credential
>>>>>>> = <suppressed>
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with
>>>>>>> the following parameters:
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:194] -   dn =
>>>>>>> ou=public,dc=abc,dc=com
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:195] -   filter =
>>>>>>> (uid=<USERNAME>)
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:196] -   filterArgs
>>>>>>> = []
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:197] -
>>>>>>> searchControls = javax.naming.directory.SearchControls at 1c28517
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:198] -   handler =
>>>>>>> [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1afe460,
>>>>>>> edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler at ba8fce,
>>>>>>> edu.vt.middleware.ldap.handler.BinarySearchResultHandler at 3744bc]
>>>>>>> 13:43:54.730 - DEBUG
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>>>>>> - Resolved attribute uid containing 0 values
>>>>>>> 13:43:54.730 - DEBUG
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>>>> - Resolving attribute mail for principal <USERNAME>
>>>>>>> 13:43:54.730 - DEBUG
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>>>>>> - Resolved attribute mail containing 0 values
>>>>>>> 13:43:54.730 - DEBUG
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>>>> - Resolving attribute transientId for principal <USERNAME>
>>>>>>>
>>>>>>>
>>>>>>> On Tue, Aug 16, 2011 at 1:52 PM, Ashok Kumar
>>>>>>> <ashok.kumar at csueastbay.edu> wrote:
>>>>>>>>
>>>>>>>> How is your LDAP Data connector entry looks like in resolver.conf
>>>>>>>> file?
>>>>>>>>
>>>>>>>> Thanks,
>>>>>>>> -Ashok
>>>>>>>>
>>>>>>>> On Tue, Aug 16, 2011 at 1:38 PM, Pavan K <pavanonnet1986 at gmail.com>
>>>>>>>> wrote:
>>>>>>>>>
>>>>>>>>> Thank you Ashok. IN the logs i am seeing the following messages,
>>>>>>>>>
>>>>>>>>> Resolved attribute uid containing 0 values
>>>>>>>>> 13:31:29.447 - DEBUG
>>>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>>>>>> - Resolving attribute mail for principal pavank
>>>>>>>>> 13:31:29.447 - DEBUG
>>>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
>>>>>>>>> - Resolved attribute mail containing 0 values
>>>>>>>>> 13:31:29.447 - DEBUG
>>>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]
>>>>>>>>> - Resolving attribute transientId for principal pavank
>>>>>>>>>
>>>>>>>>> I did not understand why it is not getting the value from LDAP. Is
>>>>>>>>> there configuration i am missing?
>>>>>>>>>
>>>>>>>>> Thank you,
>>>>>>>>> Pavan
>>>>>>>>>
>>>>>>>>> On Tue, Aug 16, 2011 at 1:05 PM, Ashok Kumar
>>>>>>>>> <ashok.kumar at csueastbay.edu> wrote:
>>>>>>>>>>
>>>>>>>>>> I think if you see the IdP access logs, it will tell you what
>>>>>>>>>> attribute has been resolved and what are filtered. You may need to set the
>>>>>>>>>> log level to debug to see all this.
>>>>>>>>>>
>>>>>>>>>> Thanks,
>>>>>>>>>> -Ashok
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> On Tue, Aug 16, 2011 at 12:42 PM, Pavan K
>>>>>>>>>> <pavanonnet1986 at gmail.com> wrote:
>>>>>>>>>>>
>>>>>>>>>>> Hi All,
>>>>>>>>>>>
>>>>>>>>>>> I am new to Shibboleth identity provider. I have installed and
>>>>>>>>>>> configured the Shibboleth identity provider by following the instructions
>>>>>>>>>>> given in shibboleth home page. I configured LDAP data connector to retrieve
>>>>>>>>>>> some attributes. And when i test the attribute resolver by using "AACLI"
>>>>>>>>>>> tool i am getting "No attribute statement" all the time. I did not find any
>>>>>>>>>>> logs related to attribute retrieval in the log files.
>>>>>>>>>>>
>>>>>>>>>>> My configuration details as follows,
>>>>>>>>>>>
>>>>>>>>>>> "handler.xml"
>>>>>>>>>>>
>>>>>>>>>>> <ph:LoginHandler xsi:type="ph:UsernamePassword"
>>>>>>>>>>>
>>>>>>>>>>> jaasConfigurationLocation="file://IDP_HOME/conf/login.config">
>>>>>>>>>>>
>>>>>>>>>>> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
>>>>>>>>>>>     </ph:LoginHandler>
>>>>>>>>>>>
>>>>>>>>>>> "login.config"
>>>>>>>>>>>
>>>>>>>>>>> edu.vt.middleware.ldap.jaas.LdapLoginModule required
>>>>>>>>>>>       ldapUrl="LDAP_URL"
>>>>>>>>>>>       baseDn="ou=public,dc=abc,dc=com"
>>>>>>>>>>>       tls="true"
>>>>>>>>>>>       userFilter="uid={0}"
>>>>>>>>>>>    ;
>>>>>>>>>>>
>>>>>>>>>>> "attribute-filter.xml"
>>>>>>>>>>>
>>>>>>>>>>> <afp:AttributeFilterPolicy>
>>>>>>>>>>>         <afp:PolicyRequirementRule xsi:type="basic:ANY" />
>>>>>>>>>>>
>>>>>>>>>>>         <afp:AttributeRule attributeID="mail">
>>>>>>>>>>>             <afp:PermitValueRule xsi:type="basic:ANY" />
>>>>>>>>>>>         </afp:AttributeRule>
>>>>>>>>>>>     </afp:AttributeFilterPolicy>
>>>>>>>>>>>
>>>>>>>>>>> "attribute-resolver.xml"
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>  <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail"
>>>>>>>>>>> sourceAttributeID="mail">
>>>>>>>>>>>         <resolver:Dependency ref="myLDAP" />
>>>>>>>>>>>     <resolver:AttributeEncoder xsi:type="SAML2String"
>>>>>>>>>>>     xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>>>>>>>>>>>             name="urn:oid:0.9.2342.19200300.100.1.1"
>>>>>>>>>>> friendlyName="mail" />
>>>>>>>>>>>     </resolver:AttributeDefinition>
>>>>>>>>>>>
>>>>>>>>>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>>>>>>>>>>>         ldapURL="LDAP_URL"
>>>>>>>>>>>         baseDN="ou=public,dc=abc,dc=com"
>>>>>>>>>>>         principal="USER_NAME"
>>>>>>>>>>>         principalCredential="PASSWORD">
>>>>>>>>>>>         <dc:FilterTemplate>
>>>>>>>>>>>             <![CDATA[
>>>>>>>>>>>                 (uid=$requestContext.principalName)
>>>>>>>>>>>             ]]>
>>>>>>>>>>>         </dc:FilterTemplate>
>>>>>>>>>>>     </resolver:DataConnector>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>>
>>>>>>>>>>> Even when i comment the statements in "login.config" file, i am
>>>>>>>>>>> not getting any errors in the log file and still getting "No Aattribute
>>>>>>>>>>> Statement" message. Following is the command i am using from "IDP_HOME"
>>>>>>>>>>>
>>>>>>>>>>> aacli.bat --configDir=../conf --principal=<USER_NAME>
>>>>>>>>>>>
>>>>>>>>>>> Could anyone please help me get this working? Am i missing
>>>>>>>>>>> something in the configruation?
>>>>>>>>>>>
>>>>>>>>>>> Thank you in advance.
>>>>>>>>>>>
>>>>>>>>>>> -- Pavan
>>>>>>>>>>>
>>>>>>>>>>> --
>>>>>>>>>>> To unsubscribe from this list send an email to
>>>>>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> --
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> --
>>>>>>>>>> To unsubscribe from this list send an email to
>>>>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> --
>>>>>>>>> To unsubscribe from this list send an email to
>>>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>> To unsubscribe from this list send an email to
>>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> To unsubscribe from this list send an email to
>>>>>>> users-unsubscribe at shibboleth.net
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> To unsubscribe from this list send an email to
>>>>>> users-unsubscribe at shibboleth.net
>>>>>
>>>>>
>>>>> --
>>>>> To unsubscribe from this list send an email to
>>>>> users-unsubscribe at shibboleth.net
>>>>
>>>>
>>>>
>>>> --
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> -Ashok Kumar
>>>> CSUEB
>>>> Email: ashok.kumar at csueastbay.edu
>>>> Phone: 510-885-2141
>>>>
>>>>
>>>> --
>>>> To unsubscribe from this list send an email to
>>>> users-unsubscribe at shibboleth.net
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>
>>
>>
>> --
>>
>>
>>
>>
>>
>> -Ashok Kumar
>> CSUEB
>> Email: ashok.kumar at csueastbay.edu
>> Phone: 510-885-2141
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered

More information about the users mailing list