Box.com and Shibboleth

[Chad Sutton]

Given that until today, when I went through every single config file 
with a fine tooth comb (again), I hadn't really know about this 
attribute I'm going to withhold full judgment until I learn a heck of a 
lot more. If that line was blank, from what I've read, I would not have 
run into this problem for the last 3 weeks trying to get SSO working 
with Box. Instead, it would have passed any attribute it was supposed to 
look up. Correct?

So from a out of the box experience that may have been more 
preferential. But from a security stand point there may be really good 
reasons that it should contain a fields list. Those fields are pulled 
when the user authenticates so the bindDN would not be needed right? So 
if I have the bindDN configured but the returnAttributes is blank in 
ldap.properties everything works. If I have no bindDN configured but I'm 
using anonSearchAuthenticator and the field is blank what happens then?

Perhaps remove the default properties from the file and add more 
comments with examples, warnings or suggestions?

Regards,
Chad Sutton - North Central College ITS
casutton at noctrl.edu
630-637-5448

On 03/03/2016 12:41 PM, Cantor, Scott wrote:
>> So it turns out, that this little bugger from ldap.properties was the
>> main problem the whole time.
> Mmm, hmm.
>
>> idp.attribute.resolver.LDAP.returnAttributes    =
>> cn,homephone,mail,uid,sn,givenName
>>
>> By default it only had cn,homephone,mail. Once I added uid,sn,givenName,
>> those properties were no longer null and they started passing. I feel
>> like banging my head against my desk over and over. :)
> Any feedback to my proposal we dump the default properties for LDAP? If not the connection details at least the semantic data...?
>
> -- Scott
>