[External] Re: Search 2nd LDAP using an attribute returned from 1st LDAP

[Zhang, Jianjun]

That worked like a charm! Thank you so much for the tip, Matt.
As soon as I added <InputDataConnector> like you pointed out, it immediately worked.

-Johnny Z

________________________________
From: Matt Brennan <brennanma at gmail.com>
Sent: Monday, April 17, 2023 4:42 PM
To: Shib Users <users at shibboleth.net>
Cc: Zhang, Jianjun <jianjun.zhang at accenturefederal.com>
Subject: [External] Re: Search 2nd LDAP using an attribute returned from 1st LDAP

You don't often get email from brennanma at gmail.com. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>

This message is from an EXTERNAL SENDER - be CAUTIOUS of links and attachments. THINK BEFORE YOU CLICK.
________________________________

Assuming that this configuration isn't now deprecated (I'm a little out of date), you need an InputDataConnector attribute.

I do this in order to do a recursive AD group membership listing for my users. My second connector looks like this:

<!-- AD Group Recursive Resolver -->
<DataConnector id="ADGroup" xsi:type="LDAPDirectory"
  ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
  baseDN="DC=corp,DC=contoso,DC=com"
  principal="%{idp.attribute.resolver.LDAP.bindDN}"
  principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
  trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
  useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
  maxResultSize="1000">
  <InputDataConnector ref="Contoso-AD" attributeNames="distinguishedName" />
  <FilterTemplate>
    <![CDATA[
      (member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))
    ]]>
  </FilterTemplate>
  <ReturnAttributes>cn</ReturnAttributes>
  <LDAPProperty name="java.naming.referral" value="follow" />
</DataConnector>

-Matt

On Mon, 17 Apr 2023 at 15:42, Zhang, Jianjun via users <users at shibboleth.net<mailto:users at shibboleth.net>> wrote:
Hi,

I have 2 separate LDAP repositories that are attached to the Shibboleth 4.3 idp. I get the attributes back from the 1st LDAP during authentication with a search filter like this in attribute-resolver.xml:

 <DataConnector id="LDAP-1" xsi:type="LDAPDirectory"
      ....
      exportAttributes="uid1,uid2,mail,name">
      <FilterTemplate>
                  <![CDATA[
                        (uid1=$resolutionContext.principal)
                   ]]>
      </FilterTemplate>
</DataConnector>

This works and it returns all attributes correctly from LDAP-1.
I need to use the returned uid2 of LDAP-1 to search the 2nd LDAP to return more attributes, but not sure how I can do it. I tried something like:

<DataConnector id="LDAP-2" xsi:type="LDAPDirectory"
      ....
      exportAttributes="uid2,auxAttr1,auxAttr2">
      <FilterTemplate>
                  <![CDATA[
                 #set ($uid2value= $uid2.get(0))
                         (uid2=$uid2value)
                   ]]>
      </FilterTemplate>
</DataConnector>

But it does not work. It seems it can't resolve $uid2value in the search filter to actual value of uid2.

Are you able to point me a direction how I should do this? Thank you very much in advance.

Johnny Zhang

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230418/32657cca/attachment.htm>