A scenario to lookup Active Directory attributes

[Etan Weintraub]

It sounds like you need to code your SP to do the lookup against your internal AD.

-Etan E. Weintraub
Sr. Systems Engineer
Directory Architecture
IT at Johns Hopkins
Johns Hopkins at Mt. Washington
5801 Smith Ave.
Suite 3110B
Baltimore, MD 21209
Phone: 410-735-7945
E-mail: eweintra at jhmi.edu

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin P. Foote
Sent: Wednesday, October 09, 2013 8:35 AM
To: Shib Users
Subject: Re: A scenario to lookup Active Directory attributes


On Wed, 9 Oct 2013, Rikard Braathen wrote:

> 1. User accesses a protected resource
> 2. Shibboleth SP redirect to external IdP
> 3. login through external IdP gives username at email.com
> 4. Would it be possible to HERE make a lookup to Active Directory, search
> for the username at email.com and retrieve the SAMAccountName together with
> the groups that the mailaddress (user) belongs to?
>
> What would be the procedure or best practise to accomplish this? Would I
> need to also install Shibboleth IdP in order to make the lookup to the AD?
> The external IdP can't talk to the internal AD.

It is a bit unclear but I'm guessing that you are the SP operator here.

I do not think an additional IdP is what you are looking for..

It is really up to you how you do any additional account linking on the back 
end of your app. If you want to further query a directory then that is up to 
the business logic found in your app. You certainly have some of the info you 
need to do this in your scenario above arriving from the external IdP ..IE the 
"username at email.com" identifier.

HTH

------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net