idpv3 ldap config question..

[Liam Hoekenga]

On Tue, Mar 17, 2015 at 9:24 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> Where is there anything in the default configuration that tries to use the
> property in ldap.properties in the resolver? I think it's only used for
> authentication config.
>

The default ldap.config doesn't include an entry for
idp.attribute.resolver.LDAP.returnAttributes, but both
attribute-resolver-full.xml and attribute-resolver-ldap.xml pull all of
their LDAP information from ldap.properties except for the return
attributes.  It didn't unreasonable to try and pull that information from
the properties file as well.

If you did want to use it in the resolver, the expression I suggested is
> probably a way to do it. In practice though, it seems unlikely that the
> same LDAP attributes would be requested in the two use cases.
>

I guess that issue isn't so much requesting that the same attributes be
retrieved by the authenticator and the resolver, but that the return
attributes for the resolver cannot be placed in the properties file.  Every
format I've tried for the resolver has failed...

idp.attribute.resolver.LDAP.returnAttributes    =  uid mail
idp.attribute.resolver.LDAP.returnAttributes    =  uid, mail
idp.attribute.resolver.LDAP.returnAttributes    =  uid,mail

It just feels like an inconsistency in the configuration.

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150318/5fdca360/attachment-0001.html