Problem templating LDAP userFilter

[Christopher Bongaarts]

On 7/1/2024 9:52 AM, Paolo Perfetti via users wrote:
>
>     If nothing else, you can apply CredentialValidator-specific
>     transforms to change the username before it gets handed to the
>     code that builds the user filter.
>
>         <util:list id="shibboleth.authn.Password.Transforms">
>             <bean parent="shibboleth.Pair" p:first="^(.+)@osu\.edu$"
>     p:second="$1" />
>         </util:list>
>
>
> Yes, this is (kind of) working and that's what I'm already doing (with 
> some limitations)
> But this solution has the big drawback that the Principal stored in 
> the session/context is just <user> (with no <domain>) and hence:
>  -  I cannot utilize the Principal to select the correct DataConnector 
> backend in the AttributeResolver (actually done with some 
> ActivationCondition)
>  -  some conflict could arise when a certain <user> exists both in 
> <domain1> and <domain2>.

You probably want to configure attribute-based subject canonicalization 
(c14n) to return something like "mail" instead of "uid".

https://shibboleth.atlassian.net/wiki/x/PJO0vg

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu           %%
%%  OIT - Identity Management  %%http://umn.edu/~cab   %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240702/54d02081/attachment.htm>