eduPersonTargetedId differs between Shibboleth IdP v2 and v3

[ROGERS Richard M]

Thanks Rod.

I found the UK Federation page on setting up IdP v3 which mentions this (and which I thought I'd read! - evidently not closely enough...). It says

The objectGUID is binary, so if it is to be used as the source attribute it should be declared as binary by adding this line to the LDAP DataConnector with id="myLDAP" immediately above the closing tag:
 <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectGUID"/>

(Incidentally, I think this is the same as in v2).

We're using objectSid rather than objectGUID, so my LDAP connector now looks like this:

<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
        <dc:FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
        <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
            <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
        </dc:StartTLSTrustCredential>
        <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid" />
    </resolver:DataConnector>

...which looks right to me, but attribute release is now failing because the resolver configuration is "invalid". I can't for the life of me see what is wrong (and cranking up the logging isn't showing me why). Any pointers welcome!

Thanks and regards

Richard


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: 21 August 2016 13:25
To: 'Shib Users' <users at shibboleth.net>
Subject: RE: eduPersonTargetedId differs between Shibboleth IdP v2 and v3

> Thanks for any suggestions
>                             sourceAttributeID="objectSid"

objectSid is binary.  Are you making sure that the LDAP is told this in your DataConnector?  IFAIR the precise syntax may have changed between the two release.

/Rod

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net