IDPv3 Attribute Resolver help

[Tim Williams]

On 08/11/16 16:50, Cantor, Scott wrote:

> Authentication and attributes are entirely separate in the configuration. Any overlap in LDAP configuration is via properties that happen to be shared or pointing to each other.

The bind credentials were only specified in one place in the
ldap.properties file, so are shared, therefore I would have expected
basic login to fail as well. There must be something configured on the
AD server which was allowing the basic auth through without the correct
user name, it's the only explanation, I was using an anonymous bind at
one point, so that might still be working. However, since this does seem
to be working, and this is only a test system I'm not going to let that
trouble me.

However, I'm still failing to get any attributes back. The only ones
which work are the uid and mail attributes. The mail attribute is
currently being generated via a template from the UID. If I change the
template, then that change is showing up on the "Information Release"
screen, so I'm assuming that the SP is correctly configured in the IDP
so that information can be sent to it.

I'm keeping things simple for now and I'm just trying to get first name
and surname back from AD. In ldap.properties, I have now added:

idp.attribute.resolver.LDAP.returnAttributes    = sn,givenName

And I've added in a suitable ReturnAttributes tag to the LDAP
DataConnector, which now looks like this:

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
        principal="%{idp.attribute.resolver.LDAP.bindDN}"

principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
        <dc:FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </dc:FilterTemplate>

<dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
    </resolver:DataConnector>

When I test this I see the following in the IDP debug output:

request=[org.ldaptive.SearchRequest at 1460049006::baseDn=DC=ad,DC=streamingltd,DC=com,
searchFilter=[org.ldaptive.SearchFilter at 1036406757::filter=(uid=dave_instructor),
parameters={}], returnAttributes=[sn, givenName], searchScope=SUBTREE,
timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false,
binaryAttributes=null, sortBehavior=UNORDERED,
searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler at -1580910376::dnAttributeName=entryDN,
addIfExists=false]], searchReferenceHandlers=null, controls=null,
followReferrals=false, intermediateResponseHandlers=null]

Which seems to indicate that the parameters I want are being included in
the request. The response is:

response=[org.ldaptive.Response at 1062607293::result=[org.ldaptive.SearchResult at 4303153::entries=[],
references=[]], resultCode=SUCCESS, message=null, matchedDn=null,
responseControls=null,
referralURLs=[ldap://ForestDnsZones.ad.streamingltd.com/DC=ForestDnsZones,DC=ad,DC=streamingltd,DC=com,
ldap://DomainDnsZones.ad.streamingltd.com/DC=DomainDnsZones,DC=ad,DC=streamingltd,DC=com,
ldap://ad.streamingltd.com/CN=Configuration,DC=ad,DC=streamingltd,DC=com],
messageId=-1]

Followed by a "Resolver plugin 'myLDAP' produced no value" error. I'm
assuming this is because the response from AD didn't include any data.
Both the sn and givenName parameters exist in the AD attributes for that
user.

For reference, the attribute resolver config for these two parameters is:

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="surname"
sourceAttributeID="sn">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:sn" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false"/>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="givenName"
sourceAttributeID="givenName">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:givenName" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.42" friendlyName="givenName" encodeType="false" />
    </resolver:AttributeDefinition>

While the attribute filter looks like this:

    <AttributeRule attributeID="givenName">
        <PermitValueRule xsi:type="ANY" />
    </AttributeRule>

    <AttributeRule attributeID="surname">
        <PermitValueRule xsi:type="ANY" />
    </AttributeRule>

Can anybody give me any clues as to why the AD server isn't sending back
the attributes I'm asking for? Is there something missing from my
request? Or are they being sent back and not interpreted correctly.

Thanks again, Tim W

-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.