IDPv3 Attribute Resolver help

[Rod Widdowson]

> I'm having an trouble getting the Attribute resolved to work with Active
> Directory. I'm trying to pass through a handful of required attributes,
> but whatever I do those attributes are never sent. Are there any step by
> step guides on how to get this to work?

I'm assuming that you have started by reading

https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration

 
> The immediate problem seems to be the LDAP dataconnector in
> attribute-resolver.xml, which is complaining about the lack of a
> trustCertificate. What is this and how do I set one up? 

And then 

https://wiki.shibboleth.net/confluence/display/IDP30/LDAPConnector , 

https://wiki.shibboleth.net/confluence/display/IDP30/StartTLSAuthenticationCredential

specifically 



Alternatively,
> since this is only intended as a test system, can I disable the
> requirement for such a certificate?

Check out the section on properties in the second reference

"idp.attribute.resolver.LDAP.useStartTLS"


> Also, since I already have a trust credential set up to enable the basic
> authentication to work, what is the point of this certificate? I would
> have expected the trust credential to be sufficient.

This is about ensuring the credibility and security of the connection you make to AD.  It has nothing to do with the security or
credibility of you connection to the SPs.

HTH

Rod