LDAP Data Connector MaxResults not honored issue

[Herron, Joel D]

Hello,
I’m trying to do some debugging on an issue I’m having in a data connector I use to populate an attribute used in our MFA Flow and I’m hitting an error that didn’t occur in 3.4.x

If the given user is a member it returns matching groups based on attribute value containing the given RecipientID. In the MFA Flow I check the attribute value for that group to conditionally require MFA.

<DataConnector id="loginFlowLDAP02" xsi:type="LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseGroupDN}"
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        lowercaseAttributeNames="true"
        derefAliases="NEVER">
        <InputAttributeDefinition ref="flowUserDN"/>
        <FilterTemplate>
            <![CDATA[
                (&(objectclass=groupOfNames)(member=$flowUserDN.get(0))(uww-group-shib-entityid=$resolutionContext.getAttributeRecipientID()))
            ]]>
        </FilterTemplate>
</DataConnector>

This is working fine in in 3.4.8; however in 4.1.0 I’m getting SIZE_LIMIT_EXCEEDED errors for users that are members of more than one group. Which looks like a bug to me as that shouldn’t happen with the defaults maxResultSize=1 and multipleResultsIsError=false unless I’m not understanding how that was working in 3.4.x.

I’ve tried setting maxResultSize=”0” and while that stops the error, it also fails to set my attribute and the MFA flow just bypasses the check.

Any Ideas how I can work around/fix this issue.

Thanks,
--Joel









-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210517/0700b90d/attachment.htm>