how to add a non-single valued attribute, like memberOf

[Cantor, Scott]

On 11/8/17, 5:52 PM, "users on behalf of Clayton" <users-bounces at shibboleth.net on behalf of upnyhgb8v6 at snkmail.com> wrote:

> So, what's the most correct OID?

I don't know what the attribute is. I don't think "memberOf" is a well-standardized one, if that's what you're talking about. I believe the eduMember work by MACE-Dir included putting a stake in the ground around that one. I don't have it to hand.

>  Why are there Syntax and Numeric ones?

A "syntax" in LDAP is how an attribute is formulated, and is never an appropriate name for a SAML Attribute. They happen to have OIDs in LDAP, but the use of OIDs in SAML is generally to map a pre-defined LDAP attribute into SAML. Whatever attribute you're pulling from has an OID name in the directory and that would at least be unambiguous. I would imagine you simply looked at some directory tool or schema and grabbed the wrong one.

> Odd that it takes that shibd so long to start - takes like 5 min and the "service shibd start" command times
> out and assumes it failed to start (which is wrong, it's just slow)

That's how long it takes to validate a signature on a file of large size and this is covered in many past threads along with the imperfect workarounds for systems with backed up metadata files already saved off.

How long it waits to decide on the status is also up to your configuration in /etc/sysconfig/shibd

-- Scott