Getting LDAP groups a user is a member of

[Rhys Smith]

Yep, my answer is completely subject (may or may not work for you) depending on your answer to Peter’s point also...
--
Dr Rhys Smith
Identity, Access, and Middleware Specialist
Cardiff University & Janet, the UK's research and education network

email: smith at cardiff.ac.uk / rhys.smith at ja.net
GPG: 0x4638C985

On 18 Jul 2014, at 15:20, Rhys Smith <Smith at cardiff.ac.uk> wrote:

> If you’re using a directory that stores this in the memberOf attribute (e.g. AD), then just add something like the following to attribute-resolver.xml (assuming the principal you use to connect to your LDAP have read rights to the attribute):
> 
>    <resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf" sourceAttributeID=“memberOf">
>        <resolver:Dependency ref="myLDAP" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:memberOf" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" />
>    </resolver:AttributeDefinition>
> 
> Note that if using something like eDirectory, this is stored in the groupMembership attribute rather than the memberOf attribute.
> 
> Also, I’ve had some thing on the other end using SAML1 that expected it to be called “isMemberOf” rather than “memberOf”, so my full attribute config (we use eDir) looks like this
> 
>    <!-- Group Membership. Exists as groupMembership in eDir, but usually known as memberOf so we use that name, also isMemberOf over SAML1 -->
>    <resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf" sourceAttributeID="groupMembership">
>        <resolver:Dependency ref="myLDAP" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:memberOf" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:isMemberOf" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" />
>    </resolver:AttributeDefinition>
> 
> Finally, note that memberOf or isMemberOf was never registered in the urn:mace:dir:attribute-def: namespace so what I’ve done is completely wrong (improper rather than won’t work), but I had some stuff on the other end that was expecting it to have that name so I just bit the bullet and did it against my own objections.
> 
> If you’re just doing this internally, and you control what the SP(s) so can map from whatever name you care to define, then the safer and more proper thing would be to just use the OID name even in SAML1, e.g.
> 
>    <resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf" sourceAttributeID="groupMembership">
>        <resolver:Dependency ref="myLDAP" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" />
>        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" />
>    </resolver:AttributeDefinition>
> 
> Of course, if this is going to be SAML2 only, then you can just ignore that problem and just have the one SAML2 encoder.
> 
> 
> HTH,
> Rhys.
> --
> Dr Rhys Smith
> Identity, Access, and Middleware Specialist
> Cardiff University & Janet, the UK's research and education network
> 
> email: smith at cardiff.ac.uk / rhys.smith at ja.net
> GPG: 0x4638C985
> 
> On 18 Jul 2014, at 14:55, Richard Genthner <moose at symplicity.com> wrote:
> 
>> I have been trying to figure out how to expose ldap groups that a user belongs too. Does anyone have ideas on how to expose these ?
>> 
>> -- 
>> -- 
>> Richard Genthner
>> Senior System Administrator
>> 
>> rgenthner at symplicity.com
>> tel. 703-351-0200 x8051
>> 
>> Direct 703-373-7033
>> 
>> sip:8051 at voip.symplicity.com
>> 
>> Symplicity Corporation
>> 
>> http://www.symplicity.com
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 841 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140718/22b1c526/attachment.bin