Using x509 login data in ldap data connector

[Juergen Schulz]

Hi Scott,

could you please send me an example of how to get the Subject's field 
out of the 'subject array' you mentioned?

Our subject looks like following:

CN: "My Name"
OU: "Sub OU"
OU: "Main OU"
O: "My Organization"
C: "My country"
UPN: "my email"

I already had a look at

     <resolver:AttributeDefinition
     xsi:type="PrincipalName"
     xmlns="urn:mace:shibboleth:2.0:resolver:ad"
     id="principal" />


But here I also only get the cn.

I tried something like this in my Data Connector:

$resolutionContext.resolvedAttributes.get("CN").get("values")[0]

But that also does not resolve.

Kind regards,
Jürgen

Am 28.11.2016 um 15:41 schrieb Cantor, Scott:
>> We are using shibboleth3 with x509 login. The login itself looks fine,
>> but now we would like to get the certificate serial number with CA or at
>> least the DN of the certificate for the ldap search.
> The certificate is inside the Java Subject's public credential set. The Subject(s) are available as of 3.3 to the context of scripted attributes and connectors as a subjects array, so using a scripted connector or attribute definition to pull out the information and then leverage that as a dependency in an LDAP connector is the easiest way I suspect.
>
>> Is there a way to somehow display the $resolutionContext?
> Not easily, no. Brent built a helper to dump out the context tree, but it's not usable outside of maybe scripting I guess. As I said, we are greatly lacking documentation of the general information exposed to the resolver.
>
> -- Scott
>