nested LDAP query to retrieve userid and groupName and fetching them at SP side

[Renzo De Renzi]

Hi guys, I succesfully setup under CentOS 6.3 an IdP that relies to an LDAP directory. Then I set un a SP on the same machine in order to secure some web pages running on Apache HTTP, the authentication is based on the userid released by the IdP/LDAP in order to match the shib.conf rules. Now I would like to protect some pages also with a group policy, so I set up a nested LDAP query that correctly matches what I need as follows:

<!-- myLDAP Connector -->
    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://localhost:10389"
        baseDN="ou=users,ou=system"
        principal="uid=admin,ou=system"
        principalCredential="secret">
        <dc:FilterTemplate>
                <![CDATA[ (uid=$requestContext.principalName) ]]>
        </dc:FilterTemplate>
    </resolver:DataConnector>

    <!-- myLDAPgroups Connector (a second LDAP connector for retrieving the users' group information)-->
    <resolver:DataConnector id="myLDAPgroups" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://localhost:10389"
        baseDN="ou=groups,ou=system"
        principal="uid=admin,ou=system"
        principalCredential="secret"
        mergeResults="true"
        maxResultSize="30">
        <dc:FilterTemplate>
               <![CDATA[ (uniquemember=uid=${requestContext.principalName},ou=users,ou=system) ]]>
        </dc:FilterTemplate>

The problem now is that either the userid and the groupName are cn type, so now the IdP releases the 2 cn attibutes but when I go printing the $_SERVER['cn'] attribute the SP concatenes the userid and groupName. Ho can I distinguish and fetch the 2 cn attribues separately?
Thanks a lot for your support