Getting role attributes from loginHandler (LDAP)

[Byte Flinger]

Hi

I have setup a Shibboleth IDP with LDAP authentication using the
LdapLoginModule authentication module. Things are working fine.

I am now trying to add some attributes to my SAML response from that in the
LDAP server. I have already managed to get the information I want from the
LDAP server in an attribute using an LDAP connector however given the fact
that such information should already be returned by the LdapLoginModule,
there should be no reason for me to have to connect again the ldap server
to retrieve such information.

In the debug logs I can see the following lines after I login the ldap
server

16:56:09.137 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:223] -
Committed the following principals:
[username[memberOf[cn=idp,ou=groups,l=er,dc=somedc,dc=com]]]
16:56:09.137 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:229] -
Committed the following roles: [cn=idp,ou=groups,l=er,dc=somedc,dc=com]


This looks to me that the ldap module adding both the role and username
somewhere within Shibboleth (requestContext maybe?).

I have been able to retrieve the username using a PrincipalName
attributeDefinition however I cannot find how to retrieve the role from the
context. The PrincipalName only returns "username" (using the example logs
given above), so I am not sure where the information inside the brackets or
even the "roles", that module claims to be commiting, can be accessed.

I can see the requestContext has a private field called
"PrincipalAttributes" however there is no get method for that field and the
"getAttributes" method returns NULL, so my script ideas so far have gone
nowhere.

Can anybody shed some light into the situation?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130620/cb9a277b/attachment.html