attribute resolver ldap dataconnector not returning entrydn

[Creado, Sylvester J. S.]

I tried putting the dn specifically, it gives an error

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Bellina, Brendan
Sent: Thursday, November 12, 2015 3:03 PM
To: Shib Users
Subject: Re: attribute resolver ldap dataconnector not returning entrydn

Interesting that specifying no attributes returns dn. Normally with an LDAP query if you don¹t specify attributes you should get all attributes back, including the dn. The wiki page <https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConne
ctor> just says about the ReturnAttributes element that "it is optional
but may help the LDAP server respond more quickly², which would certainly be true against an LDAP directory that uses aci¹s to control attribute release even for the principal being used. Nothing said about returning dn though when it is completely commented out as you have done.  Hidden feature?

Regards,

Brendan Bellina
Identity Mgmt. Architect, IT Services, UCLA






On 11/12/15, 2:21 PM, "users on behalf of Creado, Sylvester J. S."
<users-bounces at shibboleth.net on behalf of Sylvester.Creado at lmu.edu> wrote:

>Hi,
>
>The ldap dataconnector for the attribute resolver set below does not 
>return the entrydn, it is querying the oracle internet directory (oid) 
>ldap. This worked in idp v2.
>
><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>        ldapURL="ldap://ldap.lmu.edu"
>        baseDN="cn=users,dc=lmu,dc=edu"
>        principal="cn=someuser,cn=users,dc=lmu,dc=edu"
>        principalCredential="password"
>        lowercaseAttributeNames="true">
>        <dc:FilterTemplate>
>            <![CDATA[
>                (cn=$requestContext.principalName)
>            ]]>
>        </dc:FilterTemplate>
>        <!--<ReturnAttributes>cn givenname sn</ReturnAttributes>-->
>    </resolver:DataConnector>
>
>
>Please help.
>
>Grace and Peace,
>Sylvester
>--
>To unsubscribe from this list send an email to 
>users-unsubscribe at shibboleth.net

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net