Attribute Releasing Question

[Negib A. Sherif]

Tom,

Here is what I have in working environment, in my case, releasing UID for LDAP authentication. You may added or activate any additional attributes in attributes-fileter.xml, etc.   x.y.z is hostname.


In login.conf file:

   edu.vt.middleware.ldap.jaas.LdapLoginModule Sufficient
      ldapUrl="ldaps://x.y.z:636"
      baseDn="dc=x,dc=y,dc=z"
      bindDn="cn=admin,dc=x,dc=y,dc=z"
      bindCredential="password"
      ssl="true"
      userFilter="uid={0}";

In attribute-filter.xml:
    <afp:AttributeFilterPolicy id="uid">
        <afp:PolicyRequirementRule xsi:type="basic:ANY" />
        <afp:AttributeRule attributeID="uid">
           <afp:PermitValueRule xsi:type="basic:ANY"/>
        </afp:AttributeRule>
    </afp:AttributeFilterPolicy>

In attribute-resolver.xml file:
  <resolver:AttributeDefinition xsi:type="ad:Simple" id="uid" sourceAttributeID="uid">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" />
    </resolver:AttributeDefinition>

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldaps//x.y.z:389"
        baseDN="dc=x,dc=y,dc=z"
        principal="cn=admin,dc=x,dc=y,dc=z"
        principalCredential="password"
        lowercaseAttributeNames="true">
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>uid</dc:ReturnAttributes>          /* releasing UID */
        <ConnectionPool minPoolSize="3"/>
    </resolver:DataConnector>

    In attribute-map.xml file of SP:

    <Attribute name="urn:mace:dir:attribute-def:uid" id="uid">
    OR
    <Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid" />






________________________________
From: users <users-bounces at shibboleth.net> on behalf of tom greenwood <tomgreenwood87 at gmail.com>
Sent: Monday, January 25, 2016 8:03 AM
To: users at shibboleth.net
Subject: Attribute Releasing Question

Hi,

I am a new shibboleth user. I read the documentation and i just want to make sure that I understand the process of attribute release configuration. What I get is this:

On the IDP:

1- we configure the attribute-resolver.xml to fetch the attributes
2- configure the attribute-filter.xml to filter these attributes according to a policy

On the SP:

1- we configure the attribute-map.xml to map these attributes to variables
2- configure the attribute-policy.xml to accept attributes from IDP

Is this broadly how it works? or is there any other configuration files that need to be configured as well in order to make this attribute-release process works?

Thanks a lot
Tom
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160125/53ff2af8/attachment-0001.html>