Shibboleth V3 with LDAP - No Attributes

[Glaidson Verzeletti]

Hi eln00b, follows a basic script that I use here:


*1º - In "ldap.properties" file:*
You need to configure ldap server parameters

*2º - In "attribute-resolver.xml" file:*
a) configure ldap connector with returnAttributes, like "cn", "sn", ... Ex:
       <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
                ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
                baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
                principal="%{idp.attribute.resolver.LDAP.bindDN}"

principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"

useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}">
                <dc:FilterTemplate>
                        <![CDATA[
                                %{idp.attribute.resolver.LDAP.searchFilter}
                        ]]>
                </dc:FilterTemplate>
                <dc:ReturnAttributes>%{idp.authn.LDAP.returnAttributes} cn
sn mail</dc:ReturnAttributes>
        </resolver:DataConnector>

b) configure the attributes definitions. Where, id="anything" and
sourceAttributeID="ldap_attribute" Ex:
       <resolver:AttributeDefinition id="commonName" xsi:type="ad:Simple"
sourceAttributeID="cn">
                <resolver:Dependency ref="myLDAP" />
                <resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:cn" encodeType="false" />
                <resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:2.5.4.3" friendlyName="cn" encodeType="false" />
        </resolver:AttributeDefinition>


*3º - In "attribute-filter.xml" file:*
you define which attribute will be released to the SP. For every SP, ex:
       <AttributeFilterPolicy id="releaseToAnyone">
                        <PolicyRequirementRule xsi:type="ANY"/>

                        <AttributeRule attributeID="commonName">
                                <PermitValueRule xsi:type="ANY" />
                        </AttributeRule>
</AttributeFilterPolicy>
*For a specific SP, ex:*
       <AttributeFilterPolicy id="SP-01">
                <PolicyRequirementRule xsi:type="OR">
                        <Rule xsi:type="Requester" value="
https://sp01.domain.com/" />
                        <Rule xsi:type="InEntityGroup"
groupID="urn:mace:switch.ch:SWITCHaai:interfederation" />
                </PolicyRequirementRule>

                <AttributeRule attributeID="commonName">
                        <PermitValueRule xsi:type="ANY" />
                </AttributeRule>
</AttributeFilterPolicy>



This is the basic .. hope it helps...
As said Nate, we need additional details to help you better..

Regards,
Glaidson

On Thu, Oct 20, 2016 at 9:50 AM, eln00b <jbru0003 at synchronoss.com> wrote:

> I have Shibboleth set up with LDAP without any connection issues at this
> point.  Now I need to return the attributes in the response sent back to my
> Service Provider.
>
> Currently nothing is getting sent back at all.
>
> Here's some information from the various files:
>
> *conf/ldap.properties*
>
>
> *conf/attribute-resolver-ldap.xml*
>
>
> I looked in
>   - https://wiki.shibboleth.net/confluence/display/IDP30/LDAPConnector
>   -
> https://wiki.shibboleth.net/confluence/display/IDP30/
> AttributeResolverConfiguration
>
> Based on that it seems like my configuration should be correct.
>
> What am I missing and is there anything I can turn on in the /logback.xml/
> file that will help me troubleshoot?
>
>
>
>
> -----
>
> el n00b - Trying to understand technology and help create documentation
> online wherever I get stuck.
> --
> View this message in context: http://shibboleth.1660669.n2.
> nabble.com/Shibboleth-V3-with-LDAP-No-Attributes-tp7628989.html
> Sent from the Shibboleth - Users mailing list archive at Nabble.com.
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161020/f448da20/attachment.html>