Getting role attributes from loginHandler (LDAP)

[Christopher Bongaarts]

On 6/20/2013 10:47 AM, Byte Flinger wrote:
> I am now trying to add some attributes to my SAML response from that 
> in the LDAP server. I have already managed to get the information I 
> want from the LDAP server in an attribute using an LDAP connector 
> however given the fact that such information should already be 
> returned by the LdapLoginModule, there should be no reason for me to 
> have to connect again the ldap server to retrieve such information.

In general, you do connect again to LDAP to retrieve additional 
information, by configuring an LDAP DataConnector in your 
attribute-resolver.xml.   Then define an attribute based on memberOf.

The second LDAP request should be fast (you typically search based on 
the principal, which is usually a unique identifier that is equality 
indexed).

If "role" is the only thing you'll ever need to release, then you might 
be able to get away with pulling out the role from the principal, but 
I'll defer to others who might have done that...

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%