problem resolving recursive group memberships in AD

Guenther, Dean R. guenther at
Mon Jul 9 12:57:48 EDT 2018

I’ve been working with Vladimir Mencl’s documentation for resolving recursive group memberships from Active Directory.

It seems straightforward. I’m not getting an error, but I’m also not getting any groups returned. “mergeResults” has been deprecated in shib v3 so I’ve omitted that. Here is what I have. Any ideas what the problem is with my definitions?
thanks – dean

<!-- get the user's DN from the main LDAP connector (myLDAP) for searching the groups the user is in -->
<AttributeDefinition id="distinguishedName" xsi:type="Simple"
    <Dependency ref="myLDAP"/>
<!-- no encoder needed -->

<!-- search for all groups the user is recursively in - and flatten the distinguishedName(s) of all the groups into a single multivalued attribute -->

<DataConnector id="groupLDAP" xsi:type="LDAPDirectory" useStartTLS="%{idp.authn.LDAP.useStartTLS}"
                 ldapURL="%{idp.authn.LDAP.ldapURL}" baseDN="%{idp.authn.LDAP.baseDN}"
                 principal="%{idp.authn.LDAP.bindDN}" principalCredential="%{idp.authn.LDAP.bindDNCredential}"
     <Dependency ref="distinguishedName" />
    <LDAPProperty name="java.naming.referral" value="follow"/>
<!-- define the memberOf attribute based on the distinguishedName attribute returned by the groupLDAP connector - names of all groups the user is in -->

<AttributeDefinition id="memberOf" xsi:type="Simple"
    <Dependency ref="groupLDAP" />

<AttributeDefinition xsi:type="ScriptedAttribute" id="ITSTechPro">
    <Dependency ref="memberOf"/>
    <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:ITSTechPro"/>
    <AttributeEncoder xsi:type="SAML2String" name="urn:oid:" friendlyName="ITSTechPro"/>
          if (typeof memberOf != "undefined" && memberOf != null ) {
              for (i=0; memberOf != null && i < memberOf.getValues().size(); i++) {
                value = memberOf.getValues().get(i).toLowerCase();
                if (value.contains("its_techpro")) {
                        ITSTechPro.getValues().add("member"); }

Dean Guenther                          dean.guenther at<mailto:dean.guenther at>
Washington State University    Phone:    509 335-0433
Pullman, WA. 99164-1222        fax:      509 335-0540
Identity and Access Management Manager

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the users mailing list