userFilter arguments in login.config from login.jsp

[Daniel Fisher]

On Sun, Apr 28, 2013 at 5:58 PM, Juan Mucarquer <
juan.mucarquer at alumnos.usm.cl> wrote:

> Hello,
>
> I'm using vt-ldap in order to login users. The problem is there are
> duplicate UIDs in the LDAP, but in different OUs.
>
> For example exists:
> uid=john.doe,ou=people,dc=university,dc=edu
> uid=john.doe,ou=students,dc=university,dc=edu
>
> In login.config, the userFilter is set by default:
>
> userFilter=(uid={0})
>
> Where {0} is the uid supplied in the AuthUserPassLoginPage (login.jsp).
>
> As I'm reading in the vt-ldap documentation, its possible to pass another
> argument to the login module (userFilterArgs). Thats my question, how I can
> pass the OU argument ({1}) from the login.jsp, in order to login users like
> userFilter=(uid={0},ou={1})?
>
> Currently, I cannot login users where this happens, due to the search
> returns multiple DNs, and tries to login with the first it finds.
>

You could pass the userId to the LoginHandler containing both the userId
and the ou argument, perhaps like 'juan at students"
Then you could write a custom DN resolver to split the userId and inject
the argument:
https://github.com/dfish3r/sandbox/blob/master/vt-ldap/CustomDnResolver.java
Lastly, set the resolver in your login.config like
so: dnResolver="CustomDnResolver"
A filter of (&(uid={0})(ou={1})) should then format properly.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130502/4ec8ba9e/attachment-0001.html