Search 2nd LDAP using an attribute returned from 1st LDAP

[Zhang, Jianjun]

Hi,

I have 2 separate LDAP repositories that are attached to the Shibboleth 4.3 idp. I get the attributes back from the 1st LDAP during authentication with a search filter like this in attribute-resolver.xml:

 <DataConnector id="LDAP-1" xsi:type="LDAPDirectory"
      ....
      exportAttributes="uid1,uid2,mail,name">
      <FilterTemplate>
                  <![CDATA[
                        (uid1=$resolutionContext.principal)
                   ]]>
      </FilterTemplate>
</DataConnector>

This works and it returns all attributes correctly from LDAP-1.
I need to use the returned uid2 of LDAP-1 to search the 2nd LDAP to return more attributes, but not sure how I can do it. I tried something like:

<DataConnector id="LDAP-2" xsi:type="LDAPDirectory"
      ....
      exportAttributes="uid2,auxAttr1,auxAttr2">
      <FilterTemplate>
                  <![CDATA[
                 #set ($uid2value= $uid2.get(0))
                         (uid2=$uid2value)
                   ]]>
      </FilterTemplate>
</DataConnector>

But it does not work. It seems it can't resolve $uid2value in the search filter to actual value of uid2.

Are you able to point me a direction how I should do this? Thank you very much in advance.

Johnny Zhang

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230417/c29a7a0c/attachment.htm>