Providing ldap group names as an attribute revisited

[David Bantz]

On Wed, 12 Jun 2013, at 08:43 , Farrukh Najmi <farrukh at wellfleetsoftware.com> wrote:
> What does the FilterTemplate in the following mean (it is from the thread referenced above)?
> 
>      <resolver:DataConnector id="ldapGroups" xsi:type="LDAPDirectory"
> ...
>          <FilterTemplate>
>              <![CDATA[
>                 (&(objectclass=rfc822mailgroup)(member=uid=$requestContext.principalName,ou=people,dc=example,dc=edu))
>              ]]>
>          </FilterTemplate>
> 

describes how to look up the principal in your LDAP Directory given what the end-user has entered; 
in this case limiting to particular object class in the LDAP Directory and looking to match the end-user input
to member or uid of a record in ou=people… tree.

Your own merely specifies what attribute to match to to the end-user input:

>       <dc:FilterTemplate>
>             <![CDATA[
>                 (uid=$requestContext.principalName)
>             ]]>
>         </dc:FilterTemplate>


>  Do I need a second one for the ldapGroups

No, just one connector for one directory source.

> Do I need a new AttributeDefinition for the groups attribute? If so, what does that look like?
> 

   <resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        sourceAttributeID="eduIsMemberOf">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
            name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf" />
    </resolver:AttributeDefinition>

or 

    <resolver:AttributeDefinition id="ADmemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="memberOf">
	<resolver:Dependency ref="myADLDAP" />
	<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.2.840.113556.1.2.102" friendlyName="ADmemberOf" />
    </resolver:AttributeDefinition>

David Bantz

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130612/f9f47067/attachment-0001.html