shibboleth - active directory - release nested groups

[Cumer Cristiano]

Hello list,

this is the way I did manage to release nested groups fetched from active directory to a SP. Is this the correct way? Unfortunately I wasn't able to find too much documentation about this requirement.

Ciao

Cristiano Cumer


<!-- Attributes -->
<resolver:AttributeDefinition xsi:type="ad:Simple" id="isMemberOf" sourceAttributeID="cn">
    <resolver:Dependency ref="myLDAPGroup" />
    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:oid:1.3.6.1.4.1.20462.5.1.9" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String"  name="urn:oid:1.3.6.1.4.1.20462.5.1.9" friendlyName="isMemberOf" />
</resolver:AttributeDefinition>

<resolver:AttributeDefinition xsi:type="ad:Simple" id="distinguishedName" sourceAttributeID="distinguishedName">
    <resolver:Dependency ref="myLDAP" />
    <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:oid:1.3.6.1.4.1.1466.115.121.1.12" />
    <resolver:AttributeEncoder xsi:type="enc:SAML2String"  name="urn:oid:1.3.6.1.4.1.1466.115.121.1.12" friendlyName="distinguishedName" />
</resolver:AttributeDefinition>

<!-- Connectors -->
    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://xxxxx.xxxx.com"
        baseDN="dc=xxxxx,dc=com"
        principal="cn=xxxxx,ou=xxxxx,ou=xxxxxxx,dc=xxxxx,dc=com"
        principalCredential="xxxxxx">
        <dc:FilterTemplate>
            <![CDATA[
                (samAccountName=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:LDAPProperty name="java.naming.referral" value="follow"/>
    </resolver:DataConnector>


    <resolver:DataConnector id="myLDAPGroup" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://xxxxx.xxxx.com"
        baseDN="dc=xxxxx,dc=com"
        principal="cn=xxxxx,ou=xxxx,ou=xxxxxxx,dc=xxxxx,dc=com"
        principalCredential="xxxxxx" maxResultSize="1000" mergeResults="true">
        <resolver:Dependency ref="distinguishedName"/>
        <resolver:Dependency ref="myLDAP" />
        <dc:FilterTemplate>
            <![CDATA[
        (member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))
        ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>cn</dc:ReturnAttributes>
    <dc:LDAPProperty name="java.naming.referral" value="follow"/>
    </resolver:DataConnector>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131202/f6fe6368/attachment.html