group memberships from two sources

[David Bantz]

Our IdP uses both a generic LDAP directory and MS Domain AD for authentication and attributes.  We've not previously had relying services consume group membership; I'm setting that up now, and have a couple of questions on which I seek input:

(1) Our first request for group membership requests the group membership from these two sources be passed in different SAML attributes (there is little overlap in the group membership data in the two sources).  This seems reasonable enough to me, but am I missing some problem that this would entail?  I guess this has two parts: 
Is it appropriate to resolve and release the bare directory attributes 
	(as opposed to tidying them up in some way as suggested in https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples)? and
Is it appropriate to keep these in separate attributes for release (rather than combining them)?

(2) Assuming we do resolve two different attributes for SAML, 
	one based on AD's memberOf attribute 
		(values like CN=MTS-Radius,OU=RAS Client Groups,OU=Radius,OU=SW,DC=ua,DC=ad,DC=alaska,DC=edu), 
	the other based on an LDAP attribute (mis-)named eduIsMemberOf 
		(values like cn=appusers:onbaseprod:admin_document,ou=group,dc=alaska,dc=edu)
Do I simply have two resolver definitions like:

<resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="eduIsMemberOf">
	<resolver:Dependency ref="myLDAP" />
	<resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:mace:dir:attribute-def:isMemberOf" />
	<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf" />
</resolver:AttributeDefinition>


<resolver:AttributeDefinition id="ADMemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="memberOf">
	<resolver:Dependency ref="uaADLDAP" />
	<resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:mace:dir:attribute-def:ADmemberOf" />
	<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="ADmemberOf" />
</resolver:AttributeDefinition>

Thanks for your advice,

David Bantz
U Alaska IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130305/04614cb8/attachment-0001.html