Getting role attributes from loginHandler (LDAP)

[Farrukh Najmi]

In case it is helpful see this thread where I was helped by Shib 
community to get roles attributes:

http://marc.info/?l=shibboleth-users&m=137105540911093&w=2

On 06/20/2013 11:47 AM, Byte Flinger wrote:
> Hi
>
> I have setup a Shibboleth IDP with LDAP authentication using the 
> LdapLoginModule authentication module. Things are working fine.
>
> I am now trying to add some attributes to my SAML response from that 
> in the LDAP server. I have already managed to get the information I 
> want from the LDAP server in an attribute using an LDAP connector 
> however given the fact that such information should already be 
> returned by the LdapLoginModule, there should be no reason for me to 
> have to connect again the ldap server to retrieve such information.
>
> In the debug logs I can see the following lines after I login the ldap 
> server
>
> 16:56:09.137 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:223] 
> - Committed the following principals: 
> [username[memberOf[cn=idp,ou=groups,l=er,dc=somedc,dc=com]]]
> 16:56:09.137 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:229] 
> - Committed the following roles: [cn=idp,ou=groups,l=er,dc=somedc,dc=com]
>
>
> This looks to me that the ldap module adding both the role and 
> username somewhere within Shibboleth (requestContext maybe?).
>
> I have been able to retrieve the username using a PrincipalName 
> attributeDefinition however I cannot find how to retrieve the role 
> from the context. The PrincipalName only returns "username" (using the 
> example logs given above), so I am not sure where the information 
> inside the brackets or even the "roles", that module claims to be 
> commiting, can be accessed.
>
> I can see the requestContext has a private field called 
> "PrincipalAttributes" however there is no get method for that field 
> and the "getAttributes" method returns NULL, so my script ideas so far 
> have gone nowhere.
>
> Can anybody shed some light into the situation?
>

-- 
Regards,
Farrukh Najmi

Web: http://www.wellfleetsoftware.com