Providing ldap group names as an attribute revisited

[Farrukh Najmi]

Hi David,

Thanks for your patient help with this thread. I am still struggling 
with this due to my lack of familiarity with LDAP.

Here is how I define LDAP entries in my users.ldif file now. It defines 
two persons (Joe and Jane), defines a groupOfNames for role Developer 
and finally assigns Joe and Jane as members of the group Developer.

#groups definition
dn: ou=groups,dc=springframework,dc=org
objectclass: top
objectclass: organizationalUnit
ou: groups

#people definition
dn: ou=people,dc=springframework,dc=org
objectclass: top
objectclass: organizationalUnit
ou: people

#person Joe Developer1 definition
dn: uid=Developer1,ou=people,dc=springframework,dc=org
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetOrgPerson
cn: Joe Developer1
sn: Developer1
uid: Developer1
userPassword: 123456

#person Jane Developer2 definition
dn: uid=Developer2,ou=people,dc=springframework,dc=org
objectclass: top
objectclass: person
objectclass: organizationalPerson
objectclass: inetOrgPerson
cn: Jane Developer2
sn: Developer2
uid: Developer2
userPassword: abcdefg

#Role Developer definition
dn: cn=urn:test:Role:Developer,ou=groups,dc=springframework,dc=org
objectclass: top
objectclass: groupOfNames
cn: urn:test:Role:Developer
member: uid=*Developer1*,ou=people,dc=springframework,dc=org
member: uid=Developer2,ou=people,dc=springframework,dc=org

#Role Manager definition
dn: cn=urn:test:Role:Manager,ou=groups,dc=springframework,dc=org
objectclass: top
objectclass: groupOfNames
cn: urn:test:Role:Manager
member: uid=*Developer1*,ou=people,dc=springframework,dc=org


When I login with IdP using Developer1 credentials, I would like the 
resulting <saml2:Assertion> to contain the cn (preferred) or dn of the 
groupOfNames that Developer1 is a member of.

<saml2:AttributeStatement>
    <saml2:Attribute FriendlyName="uid" 
Name="urn:oid:0.9.2342.19200300.100.1.1" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
       <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xs:string">Developer1</saml2:AttributeValue>
    </saml2:Attribute>
    <saml2:Attribute FriendlyName="isMemberOf" 
Name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" 
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
       <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xs:string">*urn:test:Role:Developer*</saml2:AttributeValue>
       <saml2:AttributeValue 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:type="xs:string">*urn:test:Role:Manager*</saml2:AttributeValue>
    </saml2:Attribute>
</saml2:AttributeStatement>


I am quite unclear on how Shib2 IdP configurations in 
attribute-resolver.xml works in order to extract attributes as shown above.
What is making this hard is that there seems to be a join (using 
relational term) between groupOfNames and person

I would be grateful if you can suggest how I modify my 
<resolver:DataConnector> and <resolver:AttributeDefinition> (see below) 
to extract the attributes as shown above?

Thanks again for all your kind help.

     <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"
                                      sourceAttributeID="uid">
         <resolver:Dependency ref="myLDAP" />
         <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
     </resolver:AttributeDefinition>

     <resolver:AttributeDefinition xsi:type="ad:Simple" id="email"
                                   sourceAttributeID="mail">
         <resolver:Dependency ref="myLDAP" />
         <resolver:AttributeEncoder
             xsi:type="enc:SAML2String" 
name="urn:oid:0.9.2342.19200300.100.1.3"
                            friendlyName="mail" />
     </resolver:AttributeDefinition>

     <resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple" 
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  sourceAttributeID="member">
         <resolver:Dependency ref="ldapGroups" />
         <resolver:AttributeEncoder xsi:type="SAML2String" 
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf" />
     </resolver:AttributeDefinition>

     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
         ldapURL="ldap://wellfleet1.wellfleetsoftware.com:10389/"
         baseDN="dc=springframework,dc=org"
         principal="uid=admin,ou=system"
         principalCredential="ldap1"
         >
         <dc:FilterTemplate>
             <![CDATA[
                 (uid=$requestContext.principalName)
             ]]>
         </dc:FilterTemplate>

     </resolver:DataConnector>

     <resolver:DataConnector id="ldapGroups" xsi:type="dc:LDAPDirectory"
         ldapURL="ldap://wellfleet1.wellfleetsoftware.com:10389/"
         baseDN="dc=springframework,dc=org"
         principal="uid=admin,ou=system"
         principalCredential="ldap1"
         maxResultSize="500"
         mergeResults="true">
         <dc:FilterTemplate>
              <![CDATA[

(&(objectclass=groupOfNames)(member=uid=$requestContext.principalName,ou=people,dc=springframework,dc=org))
              ]]>
         </dc:FilterTemplate>
     </resolver:DataConnector>

-- 
Regards,
Farrukh Najmi

Web:http://www.wellfleetsoftware.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130614/6754175b/attachment.html