operational ldap attributes shib idp 3.x

[Jarno Huuskonen]

Hi,

On Thu, Apr 09, Raffael Sahli wrote:
> How can I include operational attributes from ldap?
> It seems like this doesn't work anymore since 3.x.
> 
> 
> 2015-04-09 10:50:24,544 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:352] -
> Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
> for 'memberOf'
> 2015-04-09 10:50:24,544 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:368] -
> Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
> dependencies for memberOf
> 2015-04-09 10:50:24,545 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:245]
> - Attribute Definition 'memberOf': produced an attribute with no values
> 2015-04-09 10:50:24,546 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:271] -
> Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition
> 'memberOf' produced an attribute with 0 values
> 2015-04-09 10:50:24,556 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:406] -
> Attribute Resolver 'ShibbolethAttributeResolver': Removing result of
> attribute definition 'memberOf', contains no values
> 
> 
> ldap.properties contains:
> idp.authn.LDAP.returnAttributes  = *
> 
> I have changed it into:
> idp.authn.LDAP.returnAttributes = *,memberOf

I think "idp.authn.LDAP.returnAttributes" is not used for
attribute-resolver (ldap.properties):
"## Return attributes during authentication
## NOTE: this is not used during attribute resolution; configure that
directly in the
## attribute-resolver.xml configuration via a DataConnector's
<dc:ReturnAttributes> element
"

We have <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
...
<dc:ReturnAttributes>* isMemberOf</dc:ReturnAttributes>
...
</resolver:DataConnector>

in attribute-resolver.xml and it seems to work.

-Jarno

-- 
Jarno Huuskonen