Anyone have a custom data connector for resolving tokenGroups from AD?

[Wessel, Keith]

One of our AD guys did make a web service for this last night; takes a DN, returns a full list of group DNs. That could work, and it uses Windows calls to resolve the SIDs which is probably faster than lots of LDAP queries. So, that's an option.

If nobody has a native custom data connector to do this, I might try it.

Thanks, Scott.
Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, August 24, 2017 2:50 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Anyone have a custom data connector for resolving tokenGroups from AD?

On 8/24/17, 3:05 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Does anyone have a data connector they've written to do this that they might want to contribute to the community? Or other
> suggestions on how to do this? I've considered Grouper's data connector, but since we don't ever plan to have all AD groups in
> Grouper, that won't be a complete list.

If it expands your options, there's a full featured HTTP connector done for 3.4 and it's easy enough to crib it into a library for now, if there's sample code around for this that's done in some other language, and you could call it as a web service.

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net