Anyone have a custom data connector for resolving tokenGroups from AD?

[Wessel, Keith]

Thanks, David. I forgot about this example; I’d seen it a couple years ago. My only concern is run time, but I guess we can try it. If it’s too slow, we take the web service route as Microsoft native code can turn SIDs into associated group DNs much faster.

Thanks for the reminder of this,
Keith


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of IAM David Bantz
Sent: Thursday, August 24, 2017 5:47 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Anyone have a custom data connector for resolving tokenGroups from AD?

Third example on the page, Contributed by Vladimir Mencl, Tuakiri Federation, New Zealand



On Thu, Aug 24, 2017 at 2:45 PM, IAM David Bantz <dabantz at alaska.edu<mailto:dabantz at alaska.edu>> wrote:
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples

David Bantz
U Alaska

On Thu, Aug 24, 2017 at 11:05 AM, Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>> wrote:
Hi, all,

We've recently started receiving more requests to be able to not only expose our users' direct group memberships in AD groups through attributes in our IdP, but also indirect group memberships.

I've so far resisted, not having the time to write a custom data connector that would query tokenGroups, decode each SID returned, then query each decoded SID to retrieven the group's DN. It's not a lot of work, but it hasn't been a priority.

Does anyone have a data connector they've written to do this that they might want to contribute to the community? Or other suggestions on how to do this? I've considered Grouper's data connector, but since we don't ever plan to have all AD groups in Grouper, that won't be a complete list.

Thanks,
Keith

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170825/1e952d64/attachment.html>