Unable to get memberOf (OpenLDAP, using memberof overlay)

[Joseph Fischetti]

Have you tried explicitly requesting memberof instead of using the +?

Admittedly, we're not using openldap, but thats how we're getting other operational attributes back.

As Peter said, up the log level.  It'll print out what it got back and what the resolved did with it.

Get Outlook for Android<https://aka.ms/ghei36>

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Tuesday, December 10, 2019 6:24:55 PM
To: users at shibboleth.net <users at shibboleth.net>
Subject: Re: Unable to get memberOf (OpenLDAP, using memberof overlay)

[EXTERNAL EMAIL]

* Stevens, M <michael.stevens at boku.com> [2019-12-10 23:57]:
> Querying with ldapsearch, I get group membership information using "\* \+",
> "\* memberof", etc., the ldap server clearly considers memberOf to be an
> operational attribute, I get it back when filtering only on "+"

The above only refers to your use of ldapsearch?
Or does everything above also work from the IDP when putting that as
content of an <ReturnAttributes> element /except/ the variant you want
"* +"?
Or does not of this work when putting it as content of ReturnAttributes?

Sorry, the above just isn't clear to me.

> I've tried about every combination possible. The logs clearly show
> "+" returning operational attributes ... just not memberOf.

Since you're looking at logs: You can always run the resolver or the
ldap stuff on DEBUG, that should show what it gets and your slapd logs
should show what the IDP requests (on the right loglevel).

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20191210/c8877a64/attachment.html>