eduPersonTargetedId differs between Shibboleth IdP v2 and v3

[ROGERS Richard M]

Follow up: I have this working as expected now. I had failed to realise that the order of the child elements is significant (has to be exactly as documented in the IdP v3 wiki - so the statement on the UK Federation page that the "LDAPProperty" element should be put immediately before the closing tag of the LDAP connector definition is not, in general, correct).

Thanks again for the pointer to this as the source of my problem!

Regards

Richard

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of ROGERS Richard M
Sent: 21 August 2016 14:36
To: 'Shib Users' <users at shibboleth.net>
Subject: RE: eduPersonTargetedId differs between Shibboleth IdP v2 and v3

Thanks Rod.

I found the UK Federation page on setting up IdP v3 which mentions this (and which I thought I'd read! - evidently not closely enough...). It says

The objectGUID is binary, so if it is to be used as the source attribute it should be declared as binary by adding this line to the LDAP DataConnector with id="myLDAP" immediately above the closing tag:
 <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectGUID"/>

(Incidentally, I think this is the same as in v2).

We're using objectSid rather than objectGUID, so my LDAP connector now looks like this:

<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
        <dc:FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
        <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
            <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
        </dc:StartTLSTrustCredential>
        <dc:LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid" />
    </resolver:DataConnector>

...which looks right to me, but attribute release is now failing because the resolver configuration is "invalid". I can't for the life of me see what is wrong (and cranking up the logging isn't showing me why). Any pointers welcome!

Thanks and regards

Richard


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Rod Widdowson
Sent: 21 August 2016 13:25
To: 'Shib Users' <users at shibboleth.net>
Subject: RE: eduPersonTargetedId differs between Shibboleth IdP v2 and v3

> Thanks for any suggestions
>                             sourceAttributeID="objectSid"

objectSid is binary.  Are you making sure that the LDAP is told this in your DataConnector?  IFAIR the precise syntax may have changed between the two release.

/Rod

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net