Providing ldap group names as an attribute revisited

[Cantor, Scott]

> Thanks for your patient help with this thread. I am still struggling with this
> due to my lack of familiarity with LDAP.

If your experience is with an RDBMS, that may be a lot easier for you than forcing yourself to use LDAP.

> Here is how I define LDAP entries in my users.ldif file now. It defines two
> persons (Joe and Jane), defines a groupOfNames for role Developer and
> finally assigns Joe and Jane as members of the group Developer.

David was assuming you would use the memberOf attribute to assign membership on the user entries, not by enumerating them in the group entries. Doing the former is more efficient for this use case than the latter.

> When I login with IdP using Developer1 credentials, I would like the resulting
> <saml2:Assertion> to contain the cn (preferred) or dn of the groupOfNames
> that Developer1 is a member of.

If you do it the less optimal way you are, then you need two connectors.

> I am quite unclear on how Shib2 IdP configurations in attribute-resolver.xml
> works in order to extract attributes as shown above.
> What is making this hard is that there seems to be a join (using relational
> term) between groupOfNames and person

Which you can't do in LDAP.

> I would be grateful if you can suggest how I modify my
> <resolver:DataConnector> and <resolver:AttributeDefinition> (see below) to
> extract the attributes as shown above?

His suggestion was that you change your LDAP entries.

-- Scott