nested LDAP query to retrieve userid and groupName and fetching them at SP side

[Mark Cairney]

Hi,

This is more of a workaround than a solution but if your LDAP server supports it you could use the "memberOf" attribute. I did a bit of playing around with it to generate eduPersonEntitlement attributes based on group memberships.
The following documentation on the Shibboleth page describes this approach in more detail with examples:

https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples

Hope this helps!

Mark


On 26 Jul 2012, at 11:15, Renzo De Renzi wrote:

> Hi guys, I succesfully setup under CentOS 6.3 an IdP that relies to an LDAP directory. Then I set un a SP on the same machine in order to secure some web pages running on Apache HTTP, the authentication is based on the userid released by the IdP/LDAP in order to match the shib.conf rules. Now I would like to protect some pages also with a group policy, so I set up a nested LDAP query that correctly matches what I need as follows:
> 
> <!-- myLDAP Connector -->
>    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>        ldapURL="ldap://localhost:10389"
>        baseDN="ou=users,ou=system"
>        principal="uid=admin,ou=system"
>        principalCredential="secret">
>        <dc:FilterTemplate>
>                <![CDATA[ (uid=$requestContext.principalName) ]]>
>        </dc:FilterTemplate>
>    </resolver:DataConnector>
> 
>    <!-- myLDAPgroups Connector (a second LDAP connector for retrieving the users' group information)-->
>    <resolver:DataConnector id="myLDAPgroups" xsi:type="dc:LDAPDirectory"
>        ldapURL="ldap://localhost:10389"
>        baseDN="ou=groups,ou=system"
>        principal="uid=admin,ou=system"
>        principalCredential="secret"
>        mergeResults="true"
>        maxResultSize="30">
>        <dc:FilterTemplate>
>               <![CDATA[ (uniquemember=uid=${requestContext.principalName},ou=users,ou=system) ]]>
>        </dc:FilterTemplate>
> 
> The problem now is that either the userid and the groupName are cn type, so now the IdP releases the 2 cn attibutes but when I go printing the $_SERVER['cn'] attribute the SP concatenes the userid and groupName. Ho can I distinguish and fetch the 2 cn attribues separately?
> Thanks a lot for your support
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 

/****************************

Mark R Cairney
ITI UNIX Section
Information Services

Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk

****************************/


-- 
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.