nested LDAP query to retrieve userid and groupName and fetching them at SP side

[Francesco Malvezzi]

Il 26/07/2012 12:15, Renzo De Renzi ha scritto:
> Hi guys, I succesfully setup under CentOS 6.3 an IdP that relies to
> an LDAP directory. Then I set un a SP on the same machine in order to
> secure some web pages running on Apache HTTP, the authentication is
> based on the userid released by the IdP/LDAP in order to match the
> shib.conf rules. Now I would like to protect some pages also with a
> group policy, so I set up a nested LDAP query that correctly matches
> what I need as follows:
> 
[...]
> 
> The problem now is that either the userid and the groupName are cn
> type, so now the IdP releases the 2 cn attibutes but when I go
> printing the $_SERVER['cn'] attribute the SP concatenes the userid
> and groupName. Ho can I distinguish and fetch the 2 cn attribues
> separately? Thanks a lot for your support -- 

simply give them two different names.

The group membership should not be named 'cn'. A solution can be:

<resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        sourceAttributeID="cn">
        <resolver:Dependency ref="myLDAPgroups" />
         <resolver:AttributeEncoder xsi:type="SAML1String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" />
         <resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1"
friendlyName="isMemberOf" />
    </resolver:AttributeDefinition>

and remove the dependency to myLDAPgroups in the 'cn' attribute.

Remember to add the isMemberOf definition to the attribute-map.xml on
the shibboleth-sp

ciao,

Francesco