ldap v3 attribute descriptions

Mark K. Miller max at psu.edu
Fri Jan 10 12:12:37 EST 2014


Before I spend more time google-ing and sorting a bunch of unhelpful 
results, let me see if someone here can provide a more direct pointer for 
me to follow.

I'm no LDAP expert, and I didn't stay at a Holiday Inn Express last night, 
but as it's being explained to me, ldap v3 has something called attribute 
descriptions.  It seems these attribute descriptions apply to multi-valued 
attributes (and, AFAIK, maybe they could even apply to single value 
attributes.)

Is there a pointer to some 'best practices' guidance, or can someone offer 
specific guidance here about how to optimally handle these attribute 
descriptions in the Shibboleth attribute-resolver.xml (or some other shib 
config file?)

For example, one attribute I've had defined in my attribute-resolver.xml 
for a long time now is "mail".  However, when I try to use an LDAP 
directory that now includes the "x-scim-primary-true" attribute 
description for mail, the mail attribute doesn't work any more.  If I 
change it to be the "mail;x-scim-primary-true" attribute, it works again. 
But, that feels like pounding in a screw with a hammer, or maybe its like 
pounding in a nail with a screw driver; it just doesn't seem like the 
right way to do things.

Practical guidance greatly appreciated!

Thanks,

Max


More information about the users mailing list