Providing ldap group names as an attribute revisited

[Farrukh Najmi]

Hi David,

Thanks very much for your help. I managed to get isMemberOf attribute 
pulled from LDAP using your guidance.

For other newbies like me I will summarize inline below...



On 06/12/2013 04:47 PM, David Bantz wrote:
>
> On Wed, 12 Jun 2013, at 08:43 , Farrukh Najmi 
> <farrukh at wellfleetsoftware.com <mailto:farrukh at wellfleetsoftware.com>> 
> wrote:
>>
>>   * What does the FilterTemplate in the following mean (it is from
>>     the thread referenced above)?
>>
>>          <resolver:DataConnector id="ldapGroups" xsi:type="LDAPDirectory"
>>
>>     ...
>>              <FilterTemplate>
>>                  <![CDATA[
>>                    
>>     (&(objectclass=rfc822mailgroup)(member=uid=$requestContext.principalName,ou=people,dc=example,dc=edu))
>>                  ]]>
>>              </FilterTemplate>
>>
>
> describes how to look up the principal in your LDAP Directory given 
> what the end-user has entered;
> in this case limiting to particular object class in the LDAP Directory 
> and looking to match the end-user input
> to member or uid of a record in ou=people... tree.

Yes. And a helpful resource I found on LDAP Filter syntax is this:

http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm

The syntax is a bit unusual for any one not exposed to it.

Above filter is a logical AND (see & operator) of two conditions.

  * objectclass is equal to rfc822mailgroup
  * member attribute is equal to
    uid=$requestContext.principalName,ou=people,dc=example,dc=edu


>
>>  Do I need a second one for the ldapGroups
>
> No, just one connector for one directory source.

I did not get this part of your suggestion. I need two filters:

  * One to match the uid for the entry representing the person, and
  * Another to match the rfc822mailgroup entry (BTW, in my LDAP data
    this was groupOfNames not rfc822mailgroup)

So I defined two separate DataConnectors as follows, one for each Filter 
in attribute-resolver.xml:

     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
         ldapURL="ldap://wellfleet1.wellfleetsoftware.com:10389/"
         baseDN="dc=springframework,dc=org"
         principal="uid=admin,ou=system"
         principalCredential="ldap1"
         >
         <dc:FilterTemplate>
             <![CDATA[
                 (uid=$requestContext.principalName)
             ]]>
         </dc:FilterTemplate>

     </resolver:DataConnector>

     <resolver:DataConnector id="ldapGroups" xsi:type="dc:LDAPDirectory"
         ldapURL="ldap://wellfleet1.wellfleetsoftware.com:10389/"
         baseDN="dc=springframework,dc=org"
         principal="uid=admin,ou=system"
         principalCredential="ldap1"
         maxResultSize="500"
         mergeResults="true">
         <dc:FilterTemplate>
              <![CDATA[

(&(objectclass=groupOfNames)(member=uid=$requestContext.principalName,ou=people,dc=springframework,dc=org))
              ]]>
         </dc:FilterTemplate>
     </resolver:DataConnector>

The first DataConnector myLDAP was referenced from AttributeDefinitions 
for the attributes for the person entry:

     <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
                                      sourceAttributeID="uid">
         <resolver:Dependency ref="myLDAP" />
         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:uid" />
         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
     </resolver:AttributeDefinition>

     <resolver:AttributeDefinition xsi:type="ad:Simple" id="email"
                                   sourceAttributeID="mail">
         <resolver:Dependency ref="myLDAP" />
         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:mail" />
         <resolver:AttributeEncoder
             xsi:type="enc:SAML2String" 
name="urn:oid:0.9.2342.19200300.100.1.3"
                            friendlyName="mail" />
     </resolver:AttributeDefinition>

The second DataConnector ldapGroups was referenced from the 
AttributeDefinitions for the attributes for the person entry modeled 
after your suggestion:

     <resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple" 
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  sourceAttributeID="member">
         <resolver:Dependency ref="ldapGroups" />
         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:isMemberOf" />
         <resolver:AttributeEncoder xsi:type="SAML2String" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf" />
     </resolver:AttributeDefinition>


>
>>  *
>>
>>     Do I need a new AttributeDefinition for the groups attribute? If
>>     so, what does that look like?
>>
>
> <resolver:AttributeDefinition 
> id="isMemberOf"xsi:type="Simple"xmlns="urn:mace:shibboleth:2.0:resolver:ad"
> sourceAttributeID="eduIsMemberOf">
> <resolver:Dependency ref="myLDAP" />
> <resolver:AttributeEncoder 
> xsi:type="SAML2String"xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
> name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1"friendlyName="isMemberOf"/>
> </resolver:AttributeDefinition>
>
> or
>
> <resolver:AttributeDefinition 
> id="ADmemberOf"xsi:type="Simple"xmlns="urn:mace:shibboleth:2.0:resolver:ad"sourceAttributeID="memberOf">
> <resolver:Dependency ref="myADLDAP" />
> <resolver:AttributeEncoder 
> xsi:type="SAML2String"xmlns="urn:mace:shibboleth:2.0:attribute:encoder"name="urn:oid:1.2.840.113556.1.2.102"friendlyName="ADmemberOf"/>
> </resolver:AttributeDefinition>
>
>

I was not sure what the difference between above two was so I went with 
the first one and added an AttributeENcoder for SAML1String (see listing 
earlier).

Lastly, I had to make sure that my attribute-filter.xml file had the 
following to permit releasing the isMemberOfAttribute to any one:

         <afp:AttributeRule attributeID="isMemberOf">
             <afp:PermitValueRule xsi:type="basic:ANY"/>
         </afp:AttributeRule>

This all worked like a charm. Thank you for your terrific help!


-- 
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130612/51aec45c/attachment.html