LDAP: entryDN for groupOfNames

[ls Lidz]

Posting here offered the 'aha' moment -- the attribute definition was
filtering on attribute 'cn' and not 'entryDn'.

Solved now........

Thanks.

On Tue, Jul 11, 2017 at 3:34 PM, ls Lidz <lslidzgeneve at gmail.com> wrote:

> Been triaging on this for a while -- posting here on if someone can spot
> if missed anything.
>
> I'm trying to obtain all the uniqueMember of groups a user has.
>
> If using 'cn' as the returned attributes all fine; but if using entryDN,
> nada is returned via SAML but the logs show that it has successfully read
> from LDAP.
>
> idPv3.3.0
>
> The attribute definition, data connector, and logs are below.
>
> Could anyone peruse on what could have been missed...thanks.
>
>
> ATTRIBUTE DEFINITION
> <!-- uniqueMember -->
>   <resolver:AttributeDefinition id="exampleEduUniqueMember"
> xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
> sourceAttributeID="cn">
>        <resolver:Dependency ref="exampleLDAPUNIQUEMEMBER" />
>        <resolver:AttributeEncoder xsi:type="SAML2String"
>         xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
>         name="urn:mace:dir:attribute-def:exampleEduUniqueMember"
>         friendlyName="exampleEduUniqueMember"/>
>   </resolver:AttributeDefinition>
>
> DATA CONNECTOR
>
>  <resolver:DataConnector id="exampleLDAPUNIQUEMEMBER"
> xsi:type="dc:LDAPDirectory"
>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
>        baseDN="%{example.attribute.resolver.LDAP.uniqueMember.baseDN}"
>        principal="%{idp.attribute.resolver.LDAP.bindDN}"
>        principalCredential="%{idp.attribute.resolver.LDAP.
> bindDNCredential}"
>        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"
>        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
>        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
>        maxResultSize="0">
>        <resolver:FailoverDataConnector ref="ACCESSexampleLDAPUNIQUEMEMBER-staticfailoverconnector"
> />
>        <dc:FilterTemplate>
>            <![CDATA[
>                (&(objectClass=groupOfUniqueNames)(uniqueMember=uid=$
> requestContext.principalName,ou=PEOPLE,ou=IDM,dc=stg,dc=
> iam,dc=example,dc=edu))
>            ]]>
>        </dc:FilterTemplate>
>        <dc:ReturnAttributes>entryDN</dc:ReturnAttributes>
>    <dc:ConnectionPool
>            minPoolSize="%{idp.pool.LDAP.minSize}"
>            maxPoolSize="%{idp.pool.LDAP.maxSize}"
>            blockWaitTime="%{idp.pool.LDAP.blockWaitTime}"
>            validatePeriodiedully="%{idp.pool.LDAP.validatePeriodiedully}"
>            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod}"
>            expirationTime="%{idp.pool.LDAP.idleTime}"
>            failFastInitialize="%{idp.pool.LDAP.failFastInitialize}" />
>  </resolver:DataConnector>
>
>
> IDP v3.3.0 LOGS:
>
> 2017-07-11 15:16:58,081 - DEBUG [net.shibboleth.iamp.attribute.resolver.AbstractDataConnector:143]
> - [772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Data Connector
> 'exampleLDAPUNIQUEMEMBER': Attribute 'entryDN': Values
> '[StringAttributeValue{value=cn=acl2,ou=grou
> ps,ou=vmware-vcentre,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
> StringAttributeValue{value=cn=wireless,ou=groups,ou=radius,
> ou=services,dc=stg,dc=iam,dc=example,dc=edu},
> StringAttributeValue{value=cn=orchard,ou=groups,ou=ciscoise,
> ou=services,dc=stg,dc=iam,dc=example,dc=edu}, StringAttr
> ibuteValue{value=cn=ccee-rededup-users,ou=groups,ou=
> fomccee,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
> StringAttributeValue{value=cn=acl,ou=groups,ou=vmware-
> vcentre,ou=services,dc=stg,dc=iam,dc=example,dc=edu},
> StringAttributeValue{value=cn=vpn,ou=groups,ou=radius,ou=services,dc=
> stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=directory
> administrators,dc=stg,dc=iam,dc=example,dc=edu},
> StringAttributeValue{value=cn=stf_itam,ou=itam,ou=vpac,ou=
> example,ou=employee,dc=stg,dc=iam,dc=example,dc=edu},
> StringAttributeValue{value=cn=uit.adm,ou=groups,ou=uit,ou=se
> rvices,dc=stg,dc=iam,dc=example,dc=edu}]'
>
> 2017-07-11 15:16:58,082 - DEBUG [net.shibboleth.idp.attribute.
> resolver.impl.AttributeResolverImpl:385] - [772ADEE61FDB2C52BBE06B43C5184AA7]
> - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Data
> connector 'exampleLDAPUNIQUEMEMBER' resolved the follo
> wing attributes: [entryDN]
> 2017-07-11 15:16:58,082 - DEBUG [net.shibboleth.idp.attribute.
> resolver.impl.AttributeResolverImpl:427] - [772ADEE61FDB2C52BBE06B43C5184AA7]
> - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Finished
> resolving dependencies for 'exampleEduUniqueMember'
> 2017-07-11 15:16:58,083 - DEBUG [net.shibboleth.idp.attribute.resolver.
> AbstractAttributeDefinition:245] - [772ADEE61FDB2C52BBE06B43C5184AA7] -
> [IP Address] - Attribute Definition 'exampleEduUniqueMember': produced an
> attribute with no values
> 2017-07-11 15:16:58,083 - DEBUG [net.shibboleth.idp.attribute.
> resolver.impl.AttributeResolverImpl:308] - [772ADEE61FDB2C52BBE06B43C5184AA7]
> - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver':
> Attribute definition 'exampleEduUniqueMember' produced an attribu
> te with 0 values
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170711/0a39a882/attachment.html>