nested LDAP query to retrieve userid and groupName and fetching them at SP side

[Renzo De Renzi]

Thanks for you reply. I have to use an already working LDAP directory that contains inetOrgPerson objects and groups, each group contains uniqueIdentifiers attributes with persons belonging to. I believed I could change the cn group attribute with a custom one in order to distinguish it from the cn of the person.

On 26/lug/2012, at 12:40, Mark Cairney <mark.cairney at ed.ac.uk> wrote:

> Hi,
> 
> This is more of a workaround than a solution but if your LDAP server supports it you could use the "memberOf" attribute. I did a bit of playing around with it to generate eduPersonEntitlement attributes based on group memberships.
> The following documentation on the Shibboleth page describes this approach in more detail with examples:
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples
> 
> Hope this helps!
> 
> Mark
> 
> 
> On 26 Jul 2012, at 11:15, Renzo De Renzi wrote:
> 
>> Hi guys, I succesfully setup under CentOS 6.3 an IdP that relies to an LDAP directory. Then I set un a SP on the same machine in order to secure some web pages running on Apache HTTP, the authentication is based on the userid released by the IdP/LDAP in order to match the shib.conf rules. Now I would like to protect some pages also with a group policy, so I set up a nested LDAP query that correctly matches what I need as follows:
>> 
>> <!-- myLDAP Connector -->
>>   <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>>       ldapURL="ldap://localhost:10389"
>>       baseDN="ou=users,ou=system"
>>       principal="uid=admin,ou=system"
>>       principalCredential="secret">
>>       <dc:FilterTemplate>
>>               <![CDATA[ (uid=$requestContext.principalName) ]]>
>>       </dc:FilterTemplate>
>>   </resolver:DataConnector>
>> 
>>   <!-- myLDAPgroups Connector (a second LDAP connector for retrieving the users' group information)-->
>>   <resolver:DataConnector id="myLDAPgroups" xsi:type="dc:LDAPDirectory"
>>       ldapURL="ldap://localhost:10389"
>>       baseDN="ou=groups,ou=system"
>>       principal="uid=admin,ou=system"
>>       principalCredential="secret"
>>       mergeResults="true"
>>       maxResultSize="30">
>>       <dc:FilterTemplate>
>>              <![CDATA[ (uniquemember=uid=${requestContext.principalName},ou=users,ou=system) ]]>
>>       </dc:FilterTemplate>
>> 
>> The problem now is that either the userid and the groupName are cn type, so now the IdP releases the 2 cn attibutes but when I go printing the $_SERVER['cn'] attribute the SP concatenes the userid and groupName. Ho can I distinguish and fetch the 2 cn attribues separately?
>> Thanks a lot for your support
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>> 
> 
> /****************************
> 
> Mark R Cairney
> ITI UNIX Section
> Information Services
> 
> Tel: 0131 650 6565
> Email: Mark.Cairney at ed.ac.uk
> 
> ****************************/
> 
> 
> -- 
> The University of Edinburgh is a charitable body, registered in
> Scotland, with registration number SC005336.
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net