Search 2nd LDAP using an attribute returned from 1st LDAP

[Matt Brennan]

Assuming that this configuration isn't now deprecated (I'm a little out of
date), you need an InputDataConnector attribute.

I do this in order to do a recursive AD group membership listing for my
users. My second connector looks like this:

<!-- AD Group Recursive Resolver -->
<DataConnector id="ADGroup" xsi:type="LDAPDirectory"
  ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
  baseDN="DC=corp,DC=contoso,DC=com"
  principal="%{idp.attribute.resolver.LDAP.bindDN}"
  principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
  trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
  useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
  maxResultSize="1000">
  <InputDataConnector ref="Contoso-AD" attributeNames="distinguishedName" />
  <FilterTemplate>
    <![CDATA[
      (member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))
    ]]>
  </FilterTemplate>
  <ReturnAttributes>cn</ReturnAttributes>
  <LDAPProperty name="java.naming.referral" value="follow" />
</DataConnector>

-Matt

On Mon, 17 Apr 2023 at 15:42, Zhang, Jianjun via users <users at shibboleth.net>
wrote:

> Hi,
>
> I have 2 separate LDAP repositories that are attached to the Shibboleth
> 4.3 idp. I get the attributes back from the 1st LDAP during
> authentication with a search filter like this in attribute-resolver.xml:
>
>  <DataConnector id="LDAP-1" xsi:type="LDAPDirectory"
> ....
> exportAttributes="uid1,uid2,mail,name">
>   <FilterTemplate>
>             <![CDATA[
>                 (uid1=$resolutionContext.principal)
>             ]]>
> </FilterTemplate>
> </DataConnector>
>
> This works and it returns all attributes correctly from LDAP-1.
> I need to use the returned uid2 of LDAP-1 to search the 2nd LDAP to
> return more attributes, but not sure how I can do it. I tried something
> like:
>
> <DataConnector id="LDAP-2" xsi:type="LDAPDirectory"
> ....
> exportAttributes="uid2,auxAttr1,auxAttr2">
>   <FilterTemplate>
>             <![CDATA[
>   #set ($uid2value= $uid2.get(0))
>                 (uid2=$uid2value)
>             ]]>
> </FilterTemplate>
> </DataConnector>
>
> But it does not work. It seems it can't resolve $uid2value in the search
> filter to actual value of uid2.
>
> Are you able to point me a direction how I should do this? Thank you very
> much in advance.
>
> Johnny Zhang
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230417/04dded4a/attachment.htm>