Getting LDAP groups a user is a member of

Fri Jul 18 11:08:00 EDT 2014

Try something like this..

    <resolver:AttributeDefinition id="groupMembership" xsi:type="Simple"
xmlns="urn:mace:shibboleth:2.0:resolver:ad"
            sourceAttributeID="entryDN">
        <resolver:Dependency ref="groupMembership" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.16.840.1.113719.1.1.4.1.25" friendlyName="groupMembership"
/>
    </resolver:AttributeDefinition>

    <resolver:DataConnector
            id=groupMembership"
            xsi:type="LDAPDirectory"
            xmlns="urn:mace:shibboleth:2.0:resolver:dc"
            ldapURL="ldap://ldap.example.edu"
            baseDN="ou=User Groups,ou=Groups,dc=example,dc=edu"
            maxResultSize="350"
            mergeResults="true">
        <FilterTemplate>
            <![CDATA[

(&(objectclass=group)(member=uid=${requestContext.principalName},ou=people,dc=example,dc=edu))
            ]]>
        </FilterTemplate>
        <ReturnAttributes>entryDN</ReturnAttributes>
    </resolver:DataConnector>

You might want to turn on the result caching.  The query brought our
eDirectory servers to their knees (we do nested group expansion).

Liam

On Fri, Jul 18, 2014 at 10:39 AM, Richard Genthner <moose at symplicity.com>
wrote:

> I'm running on ldap and in all my scripts to get group membership, I use
> this filter
>
> "(&(objectClass=posixGroup)(memberUid=moose))" cn
>
> I"m trying to figure out how I can make shibboleth do something similar
> with out losing my authentication.
>
>   Rhys Smith <Smith at cardiff.ac.uk>
>  July 18, 2014 at 10:23 AM
> Yep, my answer is completely subject (may or may not work for you)
> depending on your answer to Peter’s point also...
> --
> Dr Rhys Smith
> Identity, Access, and Middleware Specialist
> Cardiff University & Janet, the UK's research and education network
>
> email: smith at cardiff.ac.uk / rhys.smith at ja.net
> GPG: 0x4638C985
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>   Rhys Smith <Smith at cardiff.ac.uk>
>  July 18, 2014 at 10:20 AM
> If you’re using a directory that stores this in the memberOf attribute
> (e.g. AD), then just add something like the following to
> attribute-resolver.xml (assuming the principal you use to connect to your
> LDAP have read rights to the attribute):
>
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf"
> sourceAttributeID=“memberOf">
> <resolver:Dependency ref="myLDAP" />
> <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:memberOf" />
> <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" />
> </resolver:AttributeDefinition>
>
> Note that if using something like eDirectory, this is stored in the
> groupMembership attribute rather than the memberOf attribute.
>
> Also, I’ve had some thing on the other end using SAML1 that expected it to
> be called “isMemberOf” rather than “memberOf”, so my full attribute config
> (we use eDir) looks like this
>
> <!-- Group Membership. Exists as groupMembership in eDir, but usually
> known as memberOf so we use that name, also isMemberOf over SAML1 -->
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf"
> sourceAttributeID="groupMembership">
> <resolver:Dependency ref="myLDAP" />
> <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:memberOf" />
> <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:mace:dir:attribute-def:isMemberOf" />
> <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" />
> </resolver:AttributeDefinition>
>
> Finally, note that memberOf or isMemberOf was never registered in the
> urn:mace:dir:attribute-def: namespace so what I’ve done is completely wrong
> (improper rather than won’t work), but I had some stuff on the other end
> that was expecting it to have that name so I just bit the bullet and did it
> against my own objections.
>
> If you’re just doing this internally, and you control what the SP(s) so
> can map from whatever name you care to define, then the safer and more
> proper thing would be to just use the OID name even in SAML1, e.g.
>
> <resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf"
> sourceAttributeID="groupMembership">
> <resolver:Dependency ref="myLDAP" />
> <resolver:AttributeEncoder xsi:type="enc:SAML1String"
> name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" />
> <resolver:AttributeEncoder xsi:type="enc:SAML2String"
> name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" />
> </resolver:AttributeDefinition>
>
> Of course, if this is going to be SAML2 only, then you can just ignore
> that problem and just have the one SAML2 encoder.
>
>
> HTH,
> Rhys.
> --
> Dr Rhys Smith
> Identity, Access, and Middleware Specialist
> Cardiff University & Janet, the UK's research and education network
>
> email: smith at cardiff.ac.uk / rhys.smith at ja.net
> GPG: 0x4638C985
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>   Richard Genthner <moose at symplicity.com>
>  July 18, 2014 at 9:55 AM
>  I have been trying to figure out how to expose ldap groups that a user
> belongs too. Does anyone have ideas on how to expose these ?
>
> --
>
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
>
> --
> Richard Genthner
> Senior System Administratorrgenthner at symplicity.comtel. 703-351-0200 x8051Direct 703-373-7033sip:8051 at voip.symplicity.com
> Symplicity Corporationhttp://www.symplicity.com
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140718/e27fdb0a/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: postbox-contact.jpg
Type: image/jpeg
Size: 1334 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20140718/e27fdb0a/attachment.jpg 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: postbox-contact.jpg
Type: image/jpeg
Size: 1176 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20140718/e27fdb0a/attachment-0001.jpg 