LDAP attribute resolver - search for a specific DN

[Ivan Novakov]

On 09/23/2013 12:32 PM, Peter Schober wrote:
> * Ivan Novakov <novakoi at fel.cvut.cz> [2013-09-23 11:42]:
>> I have a simple and maybe common use case - the LDAP user record
>> contains an attribute, whose value is a DN referencing another
>> record (for example, group). I would like to retrieve the record in
>> a subsequent request (through another LDAP resolver) but I can't
>> finda way, how to request for a specific DN. It seems that it is not
>> possibleto do it through setting a filter. The usual way to retrieve
>> a record by its DN is to set the DN as a base DNwithout any filter.
>
> Are you saying the LDAP DataConnector requires specifying a
> FilterTemplate and you don't want to filter anything?
> If so try adding a "noop" filter that will always match, like
> (objectClass=*).
> If the object returned by the first search is not of arbitrary
> objectclass specifying the actually expected object class would be
> better, of course (e.g. objectClass=groupOfNames).
>
> Not sure how you want to dynamically set baseDN of the DataConnector,
> in that case, though?

Yes, exactly. I can always use "some" filter, but the problem is, there 
is no way, how to set the base DN dynamically. So I just wanted to be 
sure, that I'm not missing anything.

>
> If your DSA supports the entryDN operational attribute (or the VT LDAP
> code exposes that programmaticaly, which it does in later releases,
> IIRC) you could also do a search on that instead and use your usual
> BaseDN.

It seems, that the entryDN attribute is supported. Although it's a 
vendor specific feature, it will actually work. Thanks!


-- 
Ivan Novakov <novakoi at fel.cvut.cz>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3253 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20130923/76002420/attachment.bin