IDPv3 Attribute Resolver help

[Tim Williams]

On 09/11/16 14:50, Daniel Fisher wrote:
>  
> You can sanity check your configuration using ldapsearch:
> 
> ldapsearch -H ldap://<ldapURL> -x \
>   -b DC=ad,DC=streamingltd,DC=com \
>   -D <bindDn> -W '(uid=dave_instructor)' sn givenName
> 
> Do you get the entry you expect with this command?

That is still giving me:

result: 0 Success

However, combining with this advice:

On 09/11/16 12:58, Michael A Grady wrote:
>
> You are configuring against Active Directory, correct? Are you sure
that it is 'uid' you want to be searching against, or sAMAccountName?
And if the latter, you need to be sure to change uid to sAMAccountName
for both the Authn search (if using BindAuthn, doesn't matter for the
"direct" Ad Authn) and the Resolver search.

and running:

ldapsearch -H ldap://<ldapURL> -x \
   -b DC=ad,DC=streamingltd,DC=com \
   -D <bindDn> -W '(sAMAccountName=dave_instructor)' sn givenName

Actually returns the sn and givenName attributes (hooray!)

So I put the following into my ldap.properties:

idp.attribute.resolver.LDAP.searchFilter        =
(sAMAccountName=$resolutionContext.principal)

tested the login and it I'm now seeing the correct attributes on the
Information Release page. Pheww! I'm still getting an error from the SP
saying that it didn't receive the attributes from Shib, but that is a
separate problem. I'll review the config which relates to sending the
attributes to the SP and post here again if I can't work out what's wrong.

Thanks for your help!

Tim W

-- 
Tim Williams BSc MSc MBCS
AutoTrain
58 Jacoby Place
Priory Road
Edgbaston
Birmingham
B5 7UW
United Kingdom

Web : http://www.autotrain.org, http://www.utrain.info
Tel : +44 (0)844 487 4117

AutoTrain is a trading name of EuroMotor-AutoTrain LLP
Registered in the United Kingdom, number: OC317070.