Conditioned attribute

[Jan Marek]

Hello Scott,

many thanks for your notice.

I've tried to redefine my attribute-resolver.xml according your
notice, and it genereally works, but...

What's working:

<AttributeDefinition xsi:type="Simple" id="pager" preRequested="true">
    <InputDataConnector ref="myLDAP" attributeNames="pager"/>
</AttributeDefinition>

<DataConnector id="PgIDM" xsi:type="RelationalDatabase"
     activationConditionRef="hasPager"
     exportAttributes="roomNumber">
     <BeanManagedConnection>shibboleth.IDMStorageService</BeanManagedConnection>
     <InputAttributeDefinition ref="pager" />
     <QueryTemplate>
     <![CDATA[
        SELECT mistnost FROM orgstr.pracovni_mista WHERE osobni_cislo = '${pager[0]}';
     ]]>
     </QueryTemplate>
     <Column columnName="mistnost" attributeID="roomNumber"/>
</DataConnector>

<DataConnector id="staticAttributes" xsi:type="Static" exportAttributes="o schacHomeOrganization schacHomeOrgType">
   <Attribute id="o">
      <Value>Jihoceska univerzita v Ceskych Budejovicich</Value>
   </Attribute>
   <Attribute id="schacHomeOrganization">
      <Value>jcu.cz</Value>
   </Attribute>
   <Attribute id="schacHomeOrgType">
      <Value>urn:schac:homeOrganizationType:int:university</Value>
   </Attribute>
</DataConnector>

But I have this definition of LDAP connection:

<DataConnector id="myLDAP" xsi:type="LDAPDirectory"
    ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
    baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
    principal="%{idp.attribute.resolver.LDAP.bindDN}"
    principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
    useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
    connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
    responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
    connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"
    noResultIsError="true"
    multipleResultsIsError="true"
    excludeResolutionPhases="c14n/attribute"
    exportAttributes="%{idp.authn.LDAP.returnAttributes}">
    <FilterTemplate>
        <![CDATA[
            %{idp.attribute.resolver.LDAP.searchFilter}
        ]]>
    </FilterTemplate>
    <ConnectionPool
        minPoolSize="%{idp.pool.LDAP.minSize:3}"
        maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
        blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
        validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
        validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
        validateDN="%{idp.pool.LDAP.validateDN:}"
        validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
        validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"
        prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
        expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/>
</DataConnector>

and in the file conf/ldap.properties I have this definition:

idp.authn.LDAP.returnAttributes = "uid cn eduPersonAffiliation eduPersonEntitlement eduPersonPrimaryOrgUnitDN eduPersonPrimaryAffiliation eduPersonOrgUnitDN sn ou givenName uidNumber businessCategory pager mail displayName"

And I must explicitly define "uid" and "displayName" in
attribute-resolver.xml as a Simple attribute, otherwise IdP don't
include they to the attributes.

I've tried to set

idp.loglevel.idp=DEBUG

in conf/idp.properties

and I can see, that myLDAP produce these attributes, but when IdP
goes to the filtering phase, it doesn't log, that it will be
process these two attributes.

Is there a way to debug, where these attributes "disappears"
during resolving phase?

Sincerely
Jan Marek

Dne Pá, čec 05, 2024 at 02:33:44 CEST napsal(a) Cantor, Scott:
> > When I observe this solutions: maybe I can have
> > activationConditionRef only in definition of roomNumber,
> > isn't it?
> 
> If you do that, the data connector will still run (and probably just fail when the query doesn't get formatted correctly).
> 
> What you don't need is the attribute definition, a Simple definition that doesn't actually do anything is no longer required because connectors can export directly.
> 
> Docs mention all that.
> 
> -- Scott
> 
> 

-- 
Ing. Jan Marek
University of South Bohemia
Academic Computer Centre
Phone: +420389032080
http://www.gnu.org/philosophy/no-word-attachments.cs.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240708/602aea1b/attachment.sig>