Issues with attribute-resolver.xml and Active Directory Attributes

[Andrew Klaus]

Hello,

I've been working on this issue for a couple of days now, and don't seem to
be getting anywhere.

I had no issues connecting my new Shibboleth 3 IdP installation to Active
Directory install using LDAPS and authn-ldap.  The user I'm testing with
has Display Name, First Name, and Last Name filled out in AD.

These two out of box Attribute Definitions work properly and ePPN is sent
to my Service Provider:

    <AttributeDefinition id="eduPersonPrincipalName" xsi:type="Scoped"
scope="%{idp.scope}" sourceAttributeID="uid">
        <Dependency ref="uid" />
        <AttributeEncoder xsi:type="SAML1ScopedString"
name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false"
/>
        <AttributeEncoder xsi:type="SAML2ScopedString"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
friendlyName="eduPersonPrincipalName" encodeType="false" />
    </AttributeDefinition>

    <AttributeDefinition id="uid" xsi:type="PrincipalName">
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:uid" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid"
encodeType="false" />
    </AttributeDefinition>


The following line is set in idp.properties file (I've also tried with
specifying specific AD attribute names):
idp.authn.LDAP.returnAttributes                 = *


However, whenever I try adding a new attribute definition, such as
displayName, like so:

    <AttributeDefinition id="displayName" xsi:type="Simple"
sourceAttributeID="displayName">
        <AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:displayName" encodeType="false" />
        <AttributeEncoder xsi:type="SAML2String"
name="urn:oid:2.16.840.1.113730.3.1.241" friendlyName="displayName"
encodeType="false" />
    </AttributeDefinition>


.. It errors out with an error like "no dependencies were configured". Why
is it that the "uid" Attribute Definition can be used without specifying a
Dependency, but I can't do the same with displayName (or others)?

 Since I'm using the built-in authn-ldap, I don't know of any "Dependency
ref=" that I can add to map to this Active Directory variable.  If I'm
already able to get uid from the AD connection, I shouldn't need to create
a "myLDAP" DataConnector do I?  That seems rather redundant.

Any help on this would be great.

Thanks,
Andrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170331/95144a33/attachment.html>