cannot pull isMemberOf attribute

[Douglas E Engert]

On 3/7/2014 3:30 PM, Qian, Yi wrote:
> Yes it is what exactly I put in the resolver, but we have thousands of
> groups and only one SP requests one special group

You could do what Jeffrey Crawford  suggested, but change the filter to only search for memberUid in
the one group.

We did something like this with AD searching for group membership in a set of groups
starting with XXXXX.CLOUD.*  where * is "ANY" or based on the entityID of the SP.
(In AD the member is the user's entryDN)

(&(objectclass=group)(CN=XXXXX.CLOUD.*)(member=$entryDN.get(0)))

We returned the CN (multivalued)  of the groups the user is in and comapre this against "ANY" or
a group based on the SP entityID obtained from requestCotext.getInboundMessageIssuer();

In any case the LDAP overhead in the IDP is a lot less, as most users are not in any of these
XXXXX.CLOUD.* groups.


>
> On 3/7/14 2:40 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>
>> On 3/7/2014 2:18 PM, Qian, Yi wrote:
>>> but <ReturnAttributes>* +</ReturnAttributes> is not working for me, I
>>> have
>>> to explicitly put isMemberOf, I can see the isMemberOf being pulled from
>>> LDAP, I will see how I can script to only pull the required group, at
>>> least for now, the problem is solved.
>> We use:   <ReturnAttributes>* isMemberOf</ReturnAttributes>
>>
>> (LDAP server is Oracle Directory Server Enterprise Edition version 11.x)
>>
>> -- 
>> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
>> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
>> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>