one AD dataconnector - many base DNs

[Douglas E Engert]

On 10/1/2015 8:23 AM, Vignesh, Vanna G. wrote:
> In attribute resolver, I have one active directory dataconnector. How can I use multiple baseDNs to the same data connector? I have multiple baseDN in login.config but I am not sure how to do that in
> attribute-resilver.xml
>
>    <resolver:DataConnector id="myAD" xsi:type="LDAPDirectory"
>
>          xmlns="urn:mace:shibboleth:2.0:resolver:dc"
>
>          ldapURL="*****"
>
>          baseDN="*******"
>
>          principal="*****"
>
>          principalCredential="****">
>
>          <FilterTemplate>
>
>              <![CDATA[
>
>                  (sAMAccountName=$requestContext.principalName)
>
>              ]]>
>
>          </FilterTemplate>
>
>          <dc:ReturnAttributes>*</dc:ReturnAttributes>
>
>         <LDAPProperty name="com.sun.jndi.ldap.connect.timeout" value="500"/>
>
>      </resolver:DataConnector>
>
>

One way is if you have a small fixed set of baseDNs of could have multiple data connectors.

Or just use the top level AD domain name as the BaseDN, and limit the searches to
  (&(objectClass=user)(sAMAccountName=$requestContext.principalName))
  and add any other attribute that could be used to restrict the search, if you site
has additional attributes that may indicate this is a person and not some sort of service account.

In a forest this can be complicated, as the sub domains can also be searched.
You could also search the GC if it has all the attributes you need.

Note that sAMAccountName is unique for a domain. Where as userPrincipalName is unique across an AD forest.

http://blogs.msdn.com/b/openspecification/archive/2009/07/10/understanding-unique-attributes-in-active-directory.aspx

P.S.
<dc:ReturnAttributes>*</dc:ReturnAttributes>
returns everything which for AD is a lot. You may want to list the specific attributes you want returned.
One could be entryDN which you could then parse if needed.

>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>