Escaping principalName in LDAP filters

[Elliot Kendall]

> Bottom line IMHO is that I would forget this approach and if you want to
> use user names that are going to cause trouble, process them through a
> scriptlet definition to put them into a suitable form for LDAP and then
> plug that in as a dependency of the connector.
>
> Or customize your login layer to make sure it only produces workable
> principal names (best option).

I think the "right" way to do this is with real LDAP escaping when the
filter gets built, but I'm too lazy to submit a patch, so I guess I
can't complain. So a scriptlet it is; thanks for the input.

If anyone else wants to rip it off, here's what I'm doing:

<resolver:AttributeDefinition id="ldapEscapedPrincipal" xsi:type="ad:Script">
  <ad:ScriptFile>/opt/shibboleth-idp/conf/ldapEscapedPrincipal.js</ad:ScriptFile>
</resolver:AttributeDefinition>

importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);

ldapEscapedPrincipal = new BasicAttribute("ldapEscapedPrincipal");

var p = requestContext.getPrincipalName();

p = p.replace("\x00", "\\00");
p = p.replace("*", "\\2a");
p = p.replace("(", "\\28");
p = p.replace(")", "\\29");
p = p.replace("\\", "\\5c");

ldapEscapedPrincipal.getValues().add(p);

-- 
Elliot Kendall
IAM Support Engineer - Single Sign On
Information Technology Services
University of California, San Francisco