AD nested groups

[Hong Ye]

Michael,

Thanks for your reply. I don’t know how to write a scrip to get the group names for each SID in attribute resolver. Is there an example in WIKI?

Hong

From: users <users-bounces at shibboleth.net> on behalf of "Domingues, Michael D" <michael-domingues at uiowa.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Tuesday, July 25, 2017 at 11:44 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: AD nested groups


On the topic of the question, since you're using AD, I'd see if you could use the tokenGroups attribute [1] and then translate the SIDs it contains into usable group names.



Michael



[1] https://msdn.microsoft.com/en-us/library/ms680275(v=vs.85).aspx



________________________________
From: Domingues, Michael D
Sent: Tuesday, July 25, 2017 10:21:41 AM
To: Shib Users
Subject: Re: AD nested groups


Not directly related to this question, but worth noting. Unless I'm horribly misunderstanding things (and my testing leads me to believe that this is true), I don't think that the version of Ldaptive bundled with Shibboleth (as of 3.3.1) respects java.naming.referral = "follow".



Referral chasing support was only introduced in Ldaptive 1.1.0 [1], and Shibboleth (as of 3.3.1) ships with 1.0.9.



Michael



[1] http://www.ldaptive.org/changelog.html





________________________________
From: users <users-bounces at shibboleth.net> on behalf of Hong Ye <hy93 at cornell.edu>
Sent: Tuesday, July 25, 2017 10:00:17 AM
To: Shib Users
Subject: AD nested groups


Hi,



Does anyone know how to get all the AD group membership including nested groups for a user in AttributeResolver? I tried the solution below, but it’s very slow. Is there any other solution?



<!-- get the user's DN from the main LDAP connector (myLDAP) for searching the groups the user is in -->

    <resolver:AttributeDefinition id="distinguishedName" xsi:type="ad:Simple"

              sourceAttributeID="distinguishedname">

        <resolver:Dependency ref="psdldap" />

        <!-- no encoder needed, use your existing ldap connector as dependency -->

    </resolver:AttributeDefinition>



    <!-- search for all groups the user is recursively in - and flatten the distinguishedName(s) of all the groups into a single multivalued attribute (copy from existing connector, note searchTimeLimit) -->

    <resolver:DataConnector id="groupLDAP" xsi:type="dc:LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" ldapURL="ldap://ldap-server:389" baseDN="your base dn" principal="Admin User CN" principalCredential="Admin Pass" useStartTLS="false" maxResultSize="1000" mergeResults="true" searchTimeLimit="0">

        <resolver:Dependency ref="distinguishedName" />

        <dc:FilterTemplate>

            <![CDATA[

                (member:1.2.840.113556.1.4.1941:=${distinguishedName.get(0)})

            ]]>

        </dc:FilterTemplate>

        <dc:ReturnAttributes>distinguishedName</dc:ReturnAttributes>

        <dc:LDAPProperty name="java.naming.referral" value="follow"/>

    </resolver:DataConnector>



    <resolver:AttributeDefinition id="memberOf" xsi:type="ad:Simple"

              sourceAttributeID="distinguishedName">

        <resolver:Dependency ref="groupLDAP" />

        <!-- no encoder needed -->

    </resolver:AttributeDefinition>



Thanks,

Hong






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170725/15383206/attachment-0001.html>