attribute resolver ldap dataconnector not returning entrydn

[Bellina, Brendan]

Interesting that specifying no attributes returns dn. Normally with an
LDAP query if you don¹t specify attributes you should get all attributes
back, including the dn. The wiki page
<https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConne
ctor> just says about the ReturnAttributes element that "it is optional
but may help the LDAP server respond more quickly², which would certainly
be true against an LDAP directory that uses aci¹s to control attribute
release even for the principal being used. Nothing said about returning dn
though when it is completely commented out as you have done.  Hidden
feature?

Regards,

Brendan Bellina
Identity Mgmt. Architect, IT Services, UCLA






On 11/12/15, 2:21 PM, "users on behalf of Creado, Sylvester J. S."
<users-bounces at shibboleth.net on behalf of Sylvester.Creado at lmu.edu> wrote:

>Hi,
>
>The ldap dataconnector for the attribute resolver set below does not
>return the entrydn, it is querying the oracle internet directory (oid)
>ldap. This worked in idp v2.
>
><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>        ldapURL="ldap://ldap.lmu.edu"
>        baseDN="cn=users,dc=lmu,dc=edu"
>        principal="cn=someuser,cn=users,dc=lmu,dc=edu"
>        principalCredential="password"
>        lowercaseAttributeNames="true">
>        <dc:FilterTemplate>
>            <![CDATA[
>                (cn=$requestContext.principalName)
>            ]]>
>        </dc:FilterTemplate>
>        <!--<ReturnAttributes>cn givenname sn</ReturnAttributes>-->
>    </resolver:DataConnector>
>
>
>Please help.
>
>Grace and Peace,
>Sylvester
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net