Getting role attributes from loginHandler (LDAP)

[Byte Flinger]

Hi Christopher

Thanks for the answer. As mentioned, I did indeed manage to get the wanted
information using an LDAP DataConnector however given that the role seems
to be already returned by the login module, fast or not, it's still a waste
to have to make yet another connection for information that's already been
retrieved.
Trying to get the info out of the principal is exactly what I have been
trying to do (among other ways) however so far I have had no luck.

If this is not possible, what is the use of the role parameters in the
Ldaploginmodule anyway since it works to login without it (The module
simply won't "commit" any roles, whatever that means).
On Jun 20, 2013 5:56 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:

> On 6/20/2013 10:47 AM, Byte Flinger wrote:
> > I am now trying to add some attributes to my SAML response from that
> > in the LDAP server. I have already managed to get the information I
> > want from the LDAP server in an attribute using an LDAP connector
> > however given the fact that such information should already be
> > returned by the LdapLoginModule, there should be no reason for me to
> > have to connect again the ldap server to retrieve such information.
>
> In general, you do connect again to LDAP to retrieve additional
> information, by configuring an LDAP DataConnector in your
> attribute-resolver.xml.   Then define an attribute based on memberOf.
>
> The second LDAP request should be fast (you typically search based on
> the principal, which is usually a unique identifier that is equality
> indexed).
>
> If "role" is the only thing you'll ever need to release, then you might
> be able to get away with pulling out the role from the principal, but
> I'll defer to others who might have done that...
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130620/1d21f6c5/attachment.html