Problem templating LDAP userFilter

[Paolo Perfetti]

Hi Scott and thanks for your answer,

Il giorno lun 1 lug 2024 alle ore 16:28 Cantor, Scott <cantor.2 at osu.edu> ha
scritto:

> I don't think the filter strings there are Velocity.
>
Ah, ok.

I don't understand, from conf/authn/password-authn-config.xml :

p:userFilter="#{'%{idp.authn.LDAP.userFilter.1:undefined}'.trim()}"

Which language uses the syntax '#{}' ? And the "trim()" part, who is
responsible for parsing/executing that?


>
> If nothing else, you can apply CredentialValidator-specific transforms to
> change the username before it gets handed to the code that builds the user
> filter.
>
>     <util:list id="shibboleth.authn.Password.Transforms">
>         <bean parent="shibboleth.Pair" p:first="^(.+)@osu\.edu$"
> p:second="$1" />
>     </util:list>
>

Yes, this is (kind of) working and that's what I'm already doing (with some
limitations)
But this solution has the big drawback that the Principal stored in the
session/context is just <user> (with no <domain>) and hence:
 -  I cannot utilize the Principal to select the correct DataConnector
backend in the AttributeResolver (actually done with some
ActivationCondition)
 -  some conflict could arise when a certain <user> exists both in
<domain1> and <domain2>.


> To do it non-globally the transform list has to be injected to the
> specific validator's transforms property.
>

Another solution could be to inject a property containing the <domain> in
the Session context: it could be used later to select the correct backend
but, again, I don't know how this could be done :(

Cheers,
 Paolo

>
> -- Scott
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240701/cd17f4cc/attachment.htm>