Fetch Attributes From SAML IdP

[Peter Schober]

* Saurabh Tyagi <saurabh.tyagi at thepsi.com> [2013-06-27 13:10]:
> I am trying to fetch certain values from Ldap that is connected to Idp.
> 
> I am unable to understand how to do that. I tried reading articles. 
> 
> I have made some changes if any one of u can please confirm if I am moving
> in right direction.

Undo all the changes you've made and it will mostly Just Work.

> Attribute-resolver :- (Added two fields to be fetched from Ldap)
> 
>                 <resolver:AttributeDefinition xsi:type="ad:Simple"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" id="mail"
> sourceAttributeID="mail">
> 
>                     <resolver:Dependency ref="myLDAP" />
> 
>                 </resolver:AttributeDefinition>

As mentioned above.

>                 <resolver:AttributeDefinition xsi:type="ad:Simple"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" id="dn"
> sourceAttributeID="dn">
> 
>                     <resolver:Dependency ref="myLDAP" />
> 
>                 </resolver:AttributeDefinition

An LDAP object's "dn" is not an attribute of that object. Some DSAs
chose to expose it as such using the entryDN operation attribute,
which means it will only be returned if (a) the DSA supports it, (b)
you have access to read it, and (c) you explicitly ask for it in the
LDAP DataConnector.
But IIRC the vtldap library will allow you to construct a DN
attribute, see the documentation.

> Attribute transientId was not encoded because no
> SAML2AttributeEncoder was attached to it.

The default configuration for transientId works fine and is
sufficient, i.e. undo whatever you did to break it. You can always
compare to the unmodified config files from the IdP distribution (or
VCS).

> 16:34:56.876 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute mail for principal sam at jpr.com
> 16:34:56.877 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:354] - Resolving data connector myLDAP for principal sam at jpr.com
> 16:34:56.889 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter: (uid=$requestContext.userPrincipalName)
> 16:34:56.889 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363] - LDAP data connector myLDAP - Retrieving attributes from LDAP
> 16:34:56.889 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the following parameters:
> 16:34:56.889 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype = simple
> 16:34:56.889 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn = Journal
> 16:34:56.889 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential = <suppressed>
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with the following parameters:
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:194] -   dn = cn=Users,dc=jpr,dc=com
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:195] -   filter = (uid=$requestContext.userPrincipalName)
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:196] -   filterArgs = []
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:197] -   searchControls = javax.naming.directory.SearchControls at 18ff27
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:198] -   handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1177115, edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler at 150a0, edu.vt.middleware.ldap.handler.CaseChangeSearchResultHandler at 546169, edu.vt.middleware.ldap.handler.BinarySearchResultHandler at 1c737be]
> 16:34:56.914 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]
> - Resolved attribute mail containing 0 values

Well, either the object you searched for (uid=sam at jpr.com within
cn=Users,dc=jpr,dc=com) for does not exist or it has not mail
attribute (or the binding object does not have permissions to see the
object).
Are you sure your uid attribute contains values like "sam at jpr.com",
not just "sam"? No way for anyone else to know.

So first get the LDAP to return the requested data, using whatever
LDAP tool you want (other than the Shibbololeth IdP). Once that's
working transfer the correct settings to your IDP config.

Then re-add the encoders which the default config has and which you removed.

Then the filter rule you wrote for mail will work.

-peter