Re: Using cn (commonName) as NameID

[Robo Burned]

I am working on adding data connector to the attribute-resolver.xml I have no success with examples from documentation - they reference non-existing ldap.properties. So I started to workd with example from attribute-resolver-ldap.xml file

<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
principal="%{idp.attribute.resolver.LDAP.bindDN}"
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
<dc:FilterTemplate>
<![CDATA[
%{idp.attribute.resolver.LDAP.searchFilter}
]]>
</dc:FilterTemplate>
<dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
<dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
<sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
</dc:StartTLSTrustCredential>
</resolver:DataConnector>
As by default, idp.attribute.resolver.LDAP.* properties values are referencing idp.authn.LDAP.* props.
The props are quite default except useStartTLS = false. (see all props attached). 
Now I am getting IllegalArgumentException: name  while setting bean property connectionFactory.sslConfig.credentialConfig.'trustCredential
Do I need to disable SSL in some way? I see #idp.authn.LDAP.useSSL                          = false but I see no such setting /attribute for data connector

>Среда, 25 ноября 2015, 11:34 +01:00 от Peter Schober <peter.schober at univie.ac.at>:
>
>* Robo Burned < robo at list.ru > [2015-11-25 10:40]:
>> I found the following in docs:
>> Attribute Retrieval
>> LDAP attributes are returned as part of the authentication process and exposed in the LDAPResponseContext.
>> By default, attributes will be searched for using the same connection the user authenticated on. 
>> I've added cn to both
>> idp.authn.LDAP.returnAttributes= cn,passwordExpirationTime,loginGraceRemaining
>> and 
>> idp.attribute.resolver.LDAP.returnAttributes= cn,homephone,mail
>
>This is the comment above idp.authn.LDAP.returnAttributes in my
>ldap.properties file:
>
>## Return attributes during authentication
>## NOTE: this is not used during attribute resolution; configure that directly in the
>## attribute-resolver.xml configuration via a DataConnector's <dc:ReturnAttributes> element
>
>To just get some data from LDAP into the IDP and release it either as
>SAML Attribute or NameID you use the IDP as usual, configuring the
>attribute resolver. The IDP ships will many fully functional examples.
>Here's the documentation if you prefer to ignore those:
>https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration
>https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration
>https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration
>
>-peter
>-- 
>To unsubscribe from this list send an email to  users-unsubscribe at shibboleth.net


С уважением,

Robo Burned
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151125/63ad7e41/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: trustCertificates.log
Type: application/octet-stream
Size: 8790 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20151125/63ad7e41/attachment-0002.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ldap.properties
Type: application/octet-stream
Size: 3442 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20151125/63ad7e41/attachment-0003.obj>