active directory data connection

[Steve Herrera]

Thank you for that. So if in my ldap.properties file, can I do something
like this to distinguish the difference between the different
configurations? I don't think I can because I believe there is another file
in authn that calls LDAP.ldapURL.

idp.authn.ADLDAP.ldapURL                          =
ldaps://ActiveDirectoryServer:636

idp.authn.LDAP.ldapURL                          = ldaps://OpenLdapServer:636


For active directory I need this line:

idp.authn.LDAP.userFilter                       = (sAMAccountName={user})


And LDAP I need:

idp.authn.LDAP.userFilter                       = (uid={user})


I'd like to add these additional properties but I don't know how to
reference them since they have the same name. In my testing so far, I've
removed all my openldap configuration specific configs and replaced with
the ActiveDirectory configs. I have the connection to AD working now but I
want to make it to follow standards. So it will be easier to ask for help
when needed.


Thank you.

Steve Herrera
System Administration
Information Security
Bradley University
Phone: 309 / 677-2336
FAX: 309 / 677-3460
Email:  *sherrera at fsmail.bradley.edu <sherrera at fsmail.bradley.edu>*


On Fri, Mar 26, 2021 at 2:41 PM Nate Klingenstein <ndk at signet.id> wrote:

> Steve,
>
> You need to define an additional DataConnector in attribute-resolver.xml
> no matter what.  You can choose to define additional properties in
> ldap.properties and refer to them from the new DataConnector much like the
> distributed one, or you can hardcode the values into attribute-resolver.xml
> itself.
>
> Keeping them separate is a matter of managing the dependencies of
> attributes, e.g. InputDataConnectors.
>
> Take care,
> Nate.
>
> --------
> Signet, Inc.
> The Art of Access ®
>
> https://www.signet.id
>
> -----Original message-----
> From: Steve Herrera via users
> Sent: Friday, March 26 2021, 12:52 pm
> To: Shib Users
> Cc: Steve Herrera
> Subject: active directory data connection
>
> We are running IDP 4.0.1 on ubuntu 18.04. We have it hooked into our
> openldap server to pull attributes from. We now have a need to have it pull
> a few attributes from our Active Directory.
>
> My question is, how do I configure shibboleth to be able to pull from both
> directories? I have my openldap configured in ldap.properties. Do I also
> need to add my active directory settings in there as well? If so, how do I
> set it up to keep the ldap separate from AD?  Or for my AD connection,
> would I just need to add the Data connector section in
> attribute-resolver.xml and leave ldap.properties as is?
>
> Thank you
>
> Steve Herrera
> System Administration
> Information Security
> Bradley University
> Phone: 309 / 677-2336
> FAX: 309 / 677-3460
> Email:  sherrera at fsmail.bradley.edu <mailto:sherrera at fsmail.bradley.edu>
>
> --
>
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
>
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210330/9f823aae/attachment.htm>