Attributes not being release from AD

Tom Zeller tzeller at dragonacea.biz
Thu Feb 11 16:13:30 EST 2016 

> On Feb 11, 2016, at 2:32 PM, Michael Richter <mrichter at coastal.edu> wrote:
> 
>  
> Hello all,
>     I'm a bit new Shibboleth and have gotten most of the way set up.  I am able to authenticate successfully, but I'm having issues releasing attributes from AD via LDAP using the attribute-resolver.xml and attribute-filter.xml.  I've created the Data connector in the Attribute-resolver.xml:
>  
>  
> <resolver:DataConnector id="coastal" xsi:type="dc:LDAPDirectory"
>     ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
>     baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
>     principal="%{idp.attribute.resolver.LDAP.bindDN}"
>     principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
>     useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
>     <dc:FilterTemplate>
>         <![CDATA[
>             %{idp.attribute.resolver.LDAP.searchFilter}
>         ]]>
>     </dc:FilterTemplate>
>     <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
>     <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
>         <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
>     </dc:StartTLSTrustCredential>
>     </resolver:DataConnector>
>  
> Here’s my ldap.properties file:
>  
> # LDAP authentication configuration, see authn/ldap-authn-config.xml
>  
> ## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator
> idp.authn.LDAP.authenticator= bindSearchAuthenticator
>  
> ## Connection properties ##
> #idp.authn.LDAP.ldapURL= xxxx:389
> idp.authn.LDAP.ldapURL= xxxx:389
> #idp.authn.LDAP.useStartTLS                     = false
> idp.authn.LDAP.useSSL                          = false
> #idp.authn.LDAP.connectTimeout                  = 3000
>  
> ## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
> #idp.authn.LDAP.sslConfig                       = certificateTrust
> ## If using certificateTrust above, set to the trusted certificate's path
> idp.authn.LDAP.trustCertificates= %{idp.home}/credentials/ldap-server.crt
> ## If using keyStoreTrust above, set to the truststore path
> idp.authn.LDAP.trustStore= %{idp.home}/credentials/ldap-server.truststore
>  
> ## Return attributes during authentication
> ## NOTE: this is not used during attribute resolution; configure that directly in the
> ## attribute-resolver.xml configuration via a DataConnector's <dc:ReturnAttributes> element
> idp.authn.LDAP.returnAttributes= cn,mail
>  
> ## DN resolution properties ##
>  
> # Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator
> # for AD: CN=Users,DC=example,DC=org
> idp.authn.LDAP.baseDN= DC=coastal, DC=edu
> idp.authn.LDAP.subtreeSearch                   = true
> idp.authn.LDAP.userFilter= (sAMAccountName={user})
> # bind search configuration
> # for AD: idp.authn.LDAP.bindDN=adminuser at domain.com
> idp.authn.LDAP.bindDN= xxxx at coastal.edu
> #idp.authn.LDAP.bindDNCredential= xxxx
> idp.authn.LDAP.bindDNCredential= xxxx
>  
> # Format DN resolution, used by directAuthenticator, adAuthenticator
> # for AD use idp.authn.LDAP.dnFormat=%s at domain.com
> idp.authn.LDAP.dnFormat= %s at coastal.edu
>  
> # LDAP attribute configuration, see attribute-resolver.xml
> idp.attribute.resolver.LDAP.ldapURL= %{idp.authn.LDAP.ldapURL}
> idp.attribute.resolver.LDAP.baseDN= %{idp.authn.LDAP.baseDN}
> idp.attribute.resolver.LDAP.bindDN= %{idp.authn.LDAP.bindDN}
> idp.attribute.resolver.LDAP.bindDNCredential= %{idp.authn.LDAP.bindDNCredential}
> idp.attribute.resolver.LDAP.useStartTLS= %{idp.authn.LDAP.useStartTLS:true}
> idp.attribute.resolver.LDAP.trustCertificates= %{idp.authn.LDAP.trustCertificates}
> idp.attribute.resolver.LDAP.searchFilter= (uid=$requestContext.principalName)
> idp.attribute.resolver.LDAP.returnAttributes = sn,displayName,mail,sAMAccountName
>  
> I've then defined some attributes to be released:  
>  
> <resolver:AttributeDefinition xsi:type="ad:Prescoped" id="eduPersonPrincipalName" sourceAttributeID="cn">
>         <resolver:Dependency ref="coastal" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" />
>     </resolver:AttributeDefinition>
>                 
>                 <resolver:AttributeDefinition xsi:type="ad:Simple" id="sn" sourceAttributeID="sn">
>         <resolver:Dependency ref="coastal" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" encodeType="false" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false" />
>     </resolver:AttributeDefinition>
>     
>     <resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail">
>         <resolver:Dependency ref="coastal" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
>     </resolver:AttributeDefinition>
>  
> In my Attribute-filter.xml I’ve added the entries (I’m testing using the incommon test bed)
>  
> <afp:AttributeFilterPolicy id="Incommon Federation">
>         <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://fm.incommon.org/sp" />
>  
>       <afp:AttributeRule attributeID="eduPersonPrincipalName">
>             <afp:PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
>                                 
>                                 
>                                 <afp:AttributeRule attributeID="mail">
>             <afp:PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
>                                 
>        
>                                 
>                                 <afp:AttributeRule attributeID="displayName">
>             <afp:PermitValueRule xsi:type="basic:ANY" />
>         </afp:AttributeRule>
>  
>       
>     </afp:AttributeFilterPolicy>
>  
>  
>  
>  
> When I log in via the test bed I’m successfully authenticated, but receive no attributes:
>  
>  
> 2016-02-11 14:51:07,594 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'mrichter' succeeded
> 2016-02-11 14:51:12,062 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'coastal' produced no value.
> 2016-02-11 14:51:12,500 - INFO [Shibboleth-Audit.SSO:241] - 20160211T195112Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_3dc45b2cdb437a697a2bc4e21085e075|https://fm.incommon.org/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shib1.coastal.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fb8de51164a0df1a8eb8e3f1d14a2bdf|mrichter|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxNUWzXq1oYkuk0JwultB0V44+SfEvgjVWhjLysjTMt2F4umkFW8bp2EJ1VEjvIXBdEZ5PEDKkgX2Oosabw9Eu69rNhekwhjic0gMpUpFXhaULSxoGL9OHs2mPhZQyjUBzLw==|_0ad49c4a3bf03d91688ee662da41acd9
> 2016-02-11 14:55:35,082 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'coastal' produced no value.
>  
>  
>  
> Any  ideas what I’m missing.  Again, I’m fairly new to Shibboleth, so sorry if I missed something obvious.  I tried to research this pretty extensively before posting.  Thanks!

To troubleshoot attributes, I would increase the log level of net.shibboleth.idp.attribute and org.ldaptive to DEBUG, and then use bin/aacli.[sh|bat] to test. HTH.

More information about the users mailing list