Providing ldap group names as an attribute revisited

[Farrukh Najmi]

Now that I can fetch attributes from LDAP when authenticating a subject 
with IdP using SAML protocols, I would like to include a multi-valued 
attribute that has all the groups that the subject is a member of. The 
best coverage of this in the archives that I could find was in the 
following thread:

https://groups.google.com/forum/?fromgroups#!searchin/shibboleth-users/ldap$20group/shibboleth-users/IGFGwdwUVHA/RzLAdBcRW2UJ

I would be grateful for advice on following questions:

  * What does the FilterTemplate in the following mean (it is from the
    thread referenced above)?

          <resolver:DataConnector id="ldapGroups" xsi:type="LDAPDirectory"
                  xmlns="urn:mace:shibboleth:2.

    0:resolver:dc"
                  ldapURL="ldap://ldap.example.edu
    <http://ldap.example.edu>"
                  baseDN="ou=People,dc=example,dc=edu"
                  maxResultSize="500"
                  mergeResults="true">
              <FilterTemplate>
                  <![CDATA[

    (&(objectclass=rfc822mailgroup)(member=uid=$requestContext.principalName,ou=people,dc=example,dc=edu))
                  ]]>
              </FilterTemplate>
              <ReturnAttributes>dn</ReturnAttributes>
          </resolver:DataConnector>

  *

    I already have a DataConnector as follows. Do I need a second one
    for the ldapGroups or can I have multiple FilterTemplates in same
    DataConnector.
    Here is my existing DataConnector and AttributeDefinition that
    references it:

         <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
    ldapURL="ldap://wellfleet1.wellfleetsoftware.com:10389/"
             baseDN="dc=springframework,dc=org"
             principal="uid=admin,ou=system"
             principalCredential="ldap1"
             >
             <dc:FilterTemplate>
                 <![CDATA[
                     (uid=$requestContext.principalName)
                 ]]>
             </dc:FilterTemplate>

         </resolver:DataConnector>

         <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
    sourceAttributeID="uid">
             <resolver:Dependency ref="myLDAP" />
             <resolver:AttributeEncoder xsi:type="enc:SAML1String"
    name="urn:mace:dir:attribute-def:uid" />
             <resolver:AttributeEncoder xsi:type="enc:SAML2String"
    name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
         </resolver:AttributeDefinition>

  *

    Do I need a new AttributeDefinition for the groups attribute? If so,
    what does that look like?

Thank you for all the terrific help from Scott and other community members.

Lastly, for some mysterious reason I did not get responses for one of my 
previous questions after several folks responded. I apologize for asking 
that question again after it had been answered.

-- 
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130612/d11a3ccd/attachment-0001.html