Fetch Attributes From SAML IdP
Saurabh Tyagi
saurabh.tyagi at thepsi.com
Thu Jun 27 10:23:16 EDT 2013
Hello,
I have made changes back to original in Attribute_resolver.
resolver:AttributeDefinition xsi:type="ad:TransientId" id="transientId">
<resolver:AttributeEncoder xsi:type="enc:SAML1StringNameIdentifier"
nameFormat="urn:mace:shibboleth:1.0:nameIdentifier"/>
<resolver:AttributeEncoder xsi:type="enc:SAML2StringNameID"
nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
</resolver:AttributeDefinition>
and now Just having filter in
Attribute Filter.
<afp:AttributeRule attributeID="transientId">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
<afp:AttributeRule attributeID="mail">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
<afp:AttributeRule attributeID="cn">
<afp:PermitValueRule xsi:type="basic:ANY"/>
</afp:AttributeRule>
Still getting Attribute transientId was not encoded because no
SAML2AttributeEncoder was attached to it.
My Ldap Config that are working fine in Login.config are (I am succesfully
loggin in using them)
ldapUrl="ldap://192.168.0.138"
baseDn="CN=Users,DC=fcsjpr,DC=com"
bindDn="CryoserverJournal"
bindCredential="jpr0123"
subtreeSearch="true"
ssl="false"
userField="userPrincipalName";
Below is the Setting that I am using in attribute resolver.
<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
ldapURL="ldap://192.168.0.138"
baseDN="cn=Users,dc=fcsjpr,dc=com"
principal="cn=CryoserverJournal,cn=Users,dc=fcsjpr,dc=com"
principalCredential=" jpr0123"
lowercaseAttributeNames = "true"
>
<dc:FilterTemplate>
<![CDATA[
(cn=${requestContext.principalName})
]]>
</dc:FilterTemplate>
</resolver:DataConnector>
I am not sur what wroing I am doing?
Please help.
Thanks and Regards
Saurabh Tyagi
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Peter Schober
Sent: Thursday, June 27, 2013 6:04 PM
To: users at shibboleth.net
Subject: Re: Fetch Attributes From SAML IdP
* Saurabh Tyagi <saurabh.tyagi at thepsi.com> [2013-06-27 13:10]:
> I am trying to fetch certain values from Ldap that is connected to Idp.
>
> I am unable to understand how to do that. I tried reading articles.
>
> I have made some changes if any one of u can please confirm if I am moving
> in right direction.
Undo all the changes you've made and it will mostly Just Work.
> Attribute-resolver :- (Added two fields to be fetched from Ldap)
>
> <resolver:AttributeDefinition xsi:type="ad:Simple"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" id="mail"
> sourceAttributeID="mail">
>
> <resolver:Dependency ref="myLDAP" />
>
> </resolver:AttributeDefinition>
As mentioned above.
> <resolver:AttributeDefinition xsi:type="ad:Simple"
> xmlns="urn:mace:shibboleth:2.0:attribute:encoder" id="dn"
> sourceAttributeID="dn">
>
> <resolver:Dependency ref="myLDAP" />
>
> </resolver:AttributeDefinition
An LDAP object's "dn" is not an attribute of that object. Some DSAs
chose to expose it as such using the entryDN operation attribute,
which means it will only be returned if (a) the DSA supports it, (b)
you have access to read it, and (c) you explicitly ask for it in the
LDAP DataConnector.
But IIRC the vtldap library will allow you to construct a DN
attribute, see the documentation.
> Attribute transientId was not encoded because no
> SAML2AttributeEncoder was attached to it.
The default configuration for transientId works fine and is
sufficient, i.e. undo whatever you did to break it. You can always
compare to the unmodified config files from the IdP distribution (or
VCS).
> 16:34:56.876 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.Shib
bolethAttributeResolver:314] - Resolving attribute mail for principal
sam at jpr.com
> 16:34:56.877 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.Shib
bolethAttributeResolver:354] - Resolving data connector myLDAP for principal
sam at jpr.com
> 16:34:56.889 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.data
Connector.LdapDataConnector:308] - Search filter:
(uid=$requestContext.userPrincipalName)
> 16:34:56.889 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.data
Connector.LdapDataConnector:363] - LDAP data connector myLDAP - Retrieving
attributes from LDAP
> 16:34:56.889 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with the
following parameters:
> 16:34:56.889 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - authtype =
simple
> 16:34:56.889 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn =
Journal
> 16:34:56.889 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] - credential
= <suppressed>
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with the
following parameters:
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:194] - dn =
cn=Users,dc=jpr,dc=com
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:195] - filter =
(uid=$requestContext.userPrincipalName)
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:196] - filterArgs = []
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:197] - searchControls
= javax.naming.directory.SearchControls at 18ff27
> 16:34:56.893 - DEBUG [edu.vt.middleware.ldap.Ldap:198] - handler =
[edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1177115,
edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler at 150a0,
edu.vt.middleware.ldap.handler.CaseChangeSearchResultHandler at 546169,
edu.vt.middleware.ldap.handler.BinarySearchResultHandler at 1c737be]
> 16:34:56.914 - DEBUG
>
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.Shib
bolethAttributeResolver:336]
> - Resolved attribute mail containing 0 values
Well, either the object you searched for (uid=sam at jpr.com within
cn=Users,dc=jpr,dc=com) for does not exist or it has not mail
attribute (or the binding object does not have permissions to see the
object).
Are you sure your uid attribute contains values like "sam at jpr.com",
not just "sam"? No way for anyone else to know.
So first get the LDAP to return the requested data, using whatever
LDAP tool you want (other than the Shibbololeth IdP). Once that's
working transfer the correct settings to your IDP config.
Then re-add the encoders which the default config has and which you removed.
Then the filter rule you wrote for mail will work.
-peter
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130627/38a5ff73/attachment-0001.html
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: idp_processlogs.txt
Url: http://shibboleth.net/pipermail/users/attachments/20130627/38a5ff73/attachment-0001.txt
More information about the users
mailing list