Two AD data connectors issue with Attribute-resolver

[Colon, Joseph]

Just to close the loop on this.  Thanks for all the suggestions and examples!  They definitely helped me in configuring it the way I needed it.



I was able to merge the attributes using a script in the attribute-resolver.xml file.



The problem I ran into was with Java 8.  In the idp-process.log file I would see this:

2015-10-15 14:30:26,853 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:256] - Profile Action ResolveAttributes: Error resolving attributes

net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute Definition 'eduPersonPrincipalName': unable to execute script

                    at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition.doAttributeDefinitionResolve(ScriptedAttributeDefinition.java:148)

Caused by: javax.script.ScriptException: ReferenceError: "importPackage" is not defined in <eval> at line number 1

                    at jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:455)

Caused by: jdk.nashorn.internal.runtime.ECMAException: ReferenceError: "importPackage" is not defined

                    at jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)



After I uninstalled Java 8 U 45 and installed Java 7 U 79, everything worked fine with the script.



Thanks again for all the assistance,

Joe



-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Douglas E Engert
Sent: Wednesday, October 14, 2015 7:01 PM
To: users at shibboleth.net
Subject: Re: Two AD data connectors issue with Attribute-resolver



You may need a three resolvers something like this:





     <resolver:AttributeDefinition id="AD1eduPersonPrincipalName" xsi:type="ad:Prescoped" sourceAttributeID="mail">

         <resolver:Dependency ref="AD1" />

     </resolver:AttributeDefinition>





    <resolver:AttributeDefinition id="AD3eduPersonPrincipalName" xsi:type="ad:Prescoped" sourceAttributeID="mail">

         <resolver:Dependency ref="AD3" />

    </resolver:AttributeDefinition>



    <resolver:AttributeDefinition id="eduPersonPrincipalName"  xsi:type="Script" ... >

        <resolver:Dependency ref="AD1eduPersonPrincipalName" />

        <resolver:Dependency ref="AD3eduPersonPrincipalName" />

        <Script><![CDATA[



        pick one, resolve conflicts if both exist and not the same...



        ]]></Script>

        <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" />

        <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" />



     </resolver:AttributeDefinition>







On 10/14/2015 3:09 PM, Cantor, Scott wrote:

> On 10/14/15, 4:00 PM, "users on behalf of Colon, Joseph" <users-bounces at shibboleth.net on behalf of JColon at APUS.EDU<mailto:users-bounces at shibboleth.net%20on%20behalf%20of%20JColon at APUS.EDU>> wrote:

>

>

>

>> Thanks for the info Scott,

>>

>> So if I have 2 domains, AD1 and AD3.  Is there any way to return an attribute like "mail" back to the SP no matter which domain the user exists in?

>

> There are usually a dozen ways to do anything with the resolver. Failover connectors running in sequence is one way, another would be using separate attributes from each domain and then merging the results together.

>

> -- Scott

>

>>



--



  Douglas E. Engert  <DEEngert at gmail.com<mailto:DEEngert at gmail.com>>



--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151015/8e9d32ef/attachment.html>