IDP LDAP Query only works some of the time?

[Kanuch, Andrew]

Happy April Fools, everyone!

I have created my own Attribute Resolver Script based off Vladimir Mencl's example: (https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples ) My script preforms a recursive group membership lookup in AD, and then stores that multi-value so my attribute filter can use it to determine if it should pass on attributes to a specific SP.

And it works--most of the time. : )  Occasionally the log shows that accounts will fail to pass on the needed attributes to the SP, but if the same account tries 5 minutes later-it passes on those attributes successfully.

I think it must be an issue with either the time limit we place on the LDAP query, or how the value is stored-but I'm having trouble finding data that supports either theory. Could you help me with some questions?


1.       Is there any way I can output *all* the values stored in my attribute by the recursive LDAP search? (Called 'memberof' and 'DistinguishedNamed' in the data connector below.) It would help me troubleshoot the issue.  I have tried 'passing it on' to a test SP in attempt to check the value there,  but I believe that is not working because of the multiple values stored in the attribute.

2.       Will Trace or Debug logging levels capture what the Attribute Resolver Script is doing?  Perhaps I could turn them on and wait for the problem to happen again?

3.       I do not know very much about Service Providers yet. Can SPs place a time restriction how on how long it's authentication request is valid for? If we end up having to increase the TimeLimit for the query I should make sure I know about any hard upper limit.

Thanks!

For reference if so desired, here is a copy of my attribute resolver script, and my attribute filter that uses it.

ATTRIBUTE RESOLVER:

                <resolver:DataConnector id="groupLDAP" xsi:type="dc:LDAPDirectory"
        useStartTLS="true"
        ldapURL="ldap://seadog.JACKS.LOCAL:389"
                                baseDN="DC=jacks,DC=local"
                                principal="MYUSERNAME"
        principalCredential="MYPASSWORD"
                                maxResultSize="1000"
                                mergeResults="true"
                                searchTimeLimit="PT15.000S">


                                <resolver:Dependency ref="distinguishedName" />
                                <dc:FilterTemplate>
                                                <![CDATA[
                                                                (member:1.2.840.113556.1.4.1941:=${distinguishedName.get(0)})
                                                ]]>
                                </dc:FilterTemplate>
                                <dc:ReturnAttributes>distinguishedName</dc:ReturnAttributes>


                                <dc:LDAPProperty name="java.naming.referral" value="follow"/>
                </resolver:DataConnector>

                <resolver:AttributeDefinition id="memberOf" xsi:type="ad:Simple"
          sourceAttributeID="distinguishedName">
    <resolver:Dependency ref="groupLDAP" />
    <!-- no encoder needed -->
                </resolver:AttributeDefinition>

ATTRIBUTE FILTER:

<afp:AttributeFilterPolicy id="releaseToBoxDotCom">

                                <afp:PolicyRequirementRule xsi:type="basic:AND">

                                                <basic:Rule xsi:type="basic:AttributeValueString" attributeID="memberOf" value="CN=SDSU All Shibboleth Users,OU=WWW and Intranet,DC=jacks,DC=local" ignoreCase="true"/>

                                                <basic:Rule xsi:type="basic:AttributeRequesterString" value="box.net" ignoreCase="true"/>

                                </afp:PolicyRequirementRule>


                                                <afp:AttributeRule attributeID="First Name">
                                                <!-- Permit value rule that releases any value. -->
                                                <afp:PermitValueRule xsi:type="basic:ANY" />
                                                </afp:AttributeRule>

                                                <afp:AttributeRule attributeID="Last Name">
                                                <!-- Permit value rule that releases any value. -->
                                                <afp:PermitValueRule xsi:type="basic:ANY" />
                                                </afp:AttributeRule>

                                                <afp:AttributeRule attributeID="email">
                                                <!-- Permit value rule that releases any value. -->
                                                <afp:PermitValueRule xsi:type="basic:ANY" />
                                                </afp:AttributeRule>

    </afp:AttributeFilterPolicy>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130401/114f74a3/attachment.html