Problem templating LDAP userFilter

[Paolo Perfetti]

Hi list,
  It is my first day on this list and I'm looking for help to configure a
Shibboleth IdP.  Sadly I've basically no experience with Java/Spring so I
feel like I'm missing something very trivial.

The usernames we use for our IdP look like email addresses, eg.
<user>@<domain>
We need this because we have several <domain>-specific backends and I can
choose which backend to query using some ActivationConditions. Moreover
different <domain>s can assign the same <user> with no conflicts.

The problem is that when I try to define a (LDAP) userFilter I cannot
figure out how to split the username to use only the <user> part. Ideally
I'm looking for something like this (inspired by the velocity template
syntax)

# from ldap.properties
idp.authn.LDAP.userFilter.1 = (uid={user}.split('@')[0])

I've tested countless variations, protecting special chars, url-enconding
the filter, writing the filter directly in the xml to workaround possible
issues but with no success. I always end with some parsing problem or, at
the best, with a ldaptive exception "Assertion value contains unescaped
characters".

Could anybody help pointing out that I am missing ?

Thanks for your time and help,
Cheers,
 Paolo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240701/5c2d2e85/attachment.htm>