LDAP: entryDN for groupOfNames

[ls Lidz]

Been triaging on this for a while -- posting here on if someone can spot if
missed anything.

I'm trying to obtain all the uniqueMember of groups a user has.

If using 'cn' as the returned attributes all fine; but if using entryDN,
nada is returned via SAML but the logs show that it has successfully read
from LDAP.

idPv3.3.0

The attribute definition, data connector, and logs are below.

Could anyone peruse on what could have been missed...thanks.


ATTRIBUTE DEFINITION
<!-- uniqueMember -->
  <resolver:AttributeDefinition id="exampleEduUniqueMember"
xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
sourceAttributeID="cn">
       <resolver:Dependency ref="exampleLDAPUNIQUEMEMBER" />
       <resolver:AttributeEncoder xsi:type="SAML2String"
        xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
        name="urn:mace:dir:attribute-def:exampleEduUniqueMember"
        friendlyName="exampleEduUniqueMember"/>
  </resolver:AttributeDefinition>

DATA CONNECTOR

 <resolver:DataConnector id="exampleLDAPUNIQUEMEMBER"
xsi:type="dc:LDAPDirectory"
       ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
       baseDN="%{example.attribute.resolver.LDAP.uniqueMember.baseDN}"
       principal="%{idp.attribute.resolver.LDAP.bindDN}"
       principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
       useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"
       connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
       responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
       maxResultSize="0">
       <resolver:FailoverDataConnector
ref="ACCESSexampleLDAPUNIQUEMEMBER-staticfailoverconnector" />
       <dc:FilterTemplate>
           <![CDATA[

 (&(objectClass=groupOfUniqueNames)(uniqueMember=uid=$requestContext.principalName,ou=PEOPLE,ou=IDM,dc=stg,dc=iam,dc=example,dc=edu))
           ]]>
       </dc:FilterTemplate>
       <dc:ReturnAttributes>entryDN</dc:ReturnAttributes>
   <dc:ConnectionPool
           minPoolSize="%{idp.pool.LDAP.minSize}"
           maxPoolSize="%{idp.pool.LDAP.maxSize}"
           blockWaitTime="%{idp.pool.LDAP.blockWaitTime}"
           validatePeriodiedully="%{idp.pool.LDAP.validatePeriodiedully}"
           validateTimerPeriod="%{idp.pool.LDAP.validatePeriod}"
           expirationTime="%{idp.pool.LDAP.idleTime}"
           failFastInitialize="%{idp.pool.LDAP.failFastInitialize}" />
 </resolver:DataConnector>


IDP v3.3.0 LOGS:

2017-07-11 15:16:58,081 - DEBUG
[net.shibboleth.iamp.attribute.resolver.AbstractDataConnector:143] -
[772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Data Connector
'exampleLDAPUNIQUEMEMBER': Attribute 'entryDN': Values
'[StringAttributeValue{value=cn=acl2,ou=grou
ps,ou=vmware-vcentre,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
StringAttributeValue{value=cn=wireless,ou=groups,ou=radius,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
StringAttributeValue{value=cn=orchard,ou=groups,ou=ciscoise,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
StringAttr
ibuteValue{value=cn=ccee-rededup-users,ou=groups,ou=fomccee,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
StringAttributeValue{value=cn=acl,ou=groups,ou=vmware-vcentre,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
StringAttributeValue{value=cn=vpn,ou=groups,ou=radius,ou=services,dc=
stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=directory
administrators,dc=stg,dc=iam,dc=example,dc=edu},
StringAttributeValue{value=cn=stf_itam,ou=itam,ou=vpac,ou=example,ou=employee,dc=stg,dc=iam,dc=example,dc=edu},
StringAttributeValue{value=cn=uit.adm,ou=groups,ou=uit,ou=se
rvices,dc=stg,dc=iam,dc=example,dc=edu}]'

2017-07-11 15:16:58,082 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:385] -
[772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Resolver
'ShibbolethAttributeResolver': Data connector 'exampleLDAPUNIQUEMEMBER'
resolved the follo
wing attributes: [entryDN]
2017-07-11 15:16:58,082 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:427] -
[772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Resolver
'ShibbolethAttributeResolver': Finished resolving dependencies for
'exampleEduUniqueMember'
2017-07-11 15:16:58,083 - DEBUG
[net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:245] -
[772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Definition
'exampleEduUniqueMember': produced an attribute with no values
2017-07-11 15:16:58,083 - DEBUG
[net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:308] -
[772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Resolver
'ShibbolethAttributeResolver': Attribute definition
'exampleEduUniqueMember' produced an attribu
te with 0 values
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170711/9e618fe4/attachment-0001.html>