Providing ldap group names as an attribute revisited

[David Bantz]

On Wed, 12 Jun 2013, at 13:35 , Farrukh Najmi <farrukh at wellfleetsoftware.com> wrote:

>>> 
>>>  Do I need a second one for the ldapGroups
>> 
>> No, just one connector for one directory source.
> 
> I did not get this part of your suggestion. I need two filters:

"Filter" here is not filtering the attributes returned by the Directory,
rather limiting the scope of the search for the record from which attributes will be retrieved. 



> One to match the uid for the entry representing the person...
> So I defined two separate DataConnectors as follows, one for each Filter in attribute-resolver.xml:
> 
>     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>         ldapURL="ldap://wellfleet1.wellfleetsoftware.com:10389/" 
>         baseDN="dc=springframework,dc=org"
>         principal="uid=admin,ou=system"
>         principalCredential="ldap1"
>         >
>         <dc:FilterTemplate>
>             <![CDATA[
>                 (uid=$requestContext.principalName)
>             ]]>
>         </dc:FilterTemplate>
>         
>     </resolver:DataConnector>

This will provide LDAP attributes, including group memberships for the principal with uid = end user input.
Unless your use case is very different from what I am used to, it's the only DataConnector you need to do so.
> and Another to match the rfc822mailgroup entry (BTW, in my LDAP data this was groupOfNames not rfc822mailgroup)...
>     <resolver:DataConnector id="ldapGroups" xsi:type="dc:LDAPDirectory"
>         ldapURL="ldap://wellfleet1.wellfleetsoftware.com:10389/" 
>         baseDN="dc=springframework,dc=org"
>         principal="uid=admin,ou=system"
>         principalCredential="ldap1"
>         maxResultSize="500"
>         mergeResults="true">
>         <dc:FilterTemplate>
>              <![CDATA[
>                  
> (&(objectclass=groupOfNames)(member=uid=$requestContext.principalName,ou=people,dc=springframework,dc=org))
>              ]]>
>         </dc:FilterTemplate>        
>     </resolver:DataConnector>    

I think this attempts to find a record in the same LDAP directory with uid = the end user input,
from the PEOPLE ou AND with object class goupOfNames.  I question whether your ou=people sub tree 
has "people" with the groupOfNames objectclass.

---

That is, if I am in your directory wellfleet1.wellfleetsoftware.com with uid=db0011,ou=people,dc=springframework,dc=org,
and enter that uid in your IdP login page, the myLDAP DataConnector will retrieve the attributes from that record, including 
mail and my group memberships.  Those LDAP attributes can then be sourceAttributes in your resolver definitions.

The ldapGroups DataConnector will, I suspect fail to match a record, returning no results.  If perchance you do have the object class
groupOfNames as part of my record, then it would likely retrieve the same record and the same attributes as the first DataConnector.

My apologies If you are wanting something entirely different (maybe like retrieve all the members of a particular group??).


> 
> The first DataConnector myLDAP was referenced from AttributeDefinitions for the attributes for the person entry:
> 
>     <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
>                                      sourceAttributeID="uid">
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
>                                    name="urn:mace:dir:attribute-def:uid" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
>                                    name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
>     </resolver:AttributeDefinition>
> 
>     <resolver:AttributeDefinition xsi:type="ad:Simple" id="email"
>                                   sourceAttributeID="mail">
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
>                                    name="urn:mace:dir:attribute-def:mail" />        
>         <resolver:AttributeEncoder
>             xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3"
>                            friendlyName="mail" />
>     </resolver:AttributeDefinition>
> 
> The second DataConnector ldapGroups was referenced from the AttributeDefinitions for the attributes for the person entry modeled after your suggestion:
> 
>     <resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
>                                  sourceAttributeID="member">
>         <resolver:Dependency ref="ldapGroups" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String"
>                                    name="urn:mace:dir:attribute-def:isMemberOf" />        
>         <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>                                    name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf" />
>     </resolver:AttributeDefinition>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130612/b7fa20f2/attachment-0001.html