Conditioned attribute

[Jan Marek]

Hello Peter, 

many thanks for your e-mails, these was clarified many thinks for
me.

Dne Po, čec 08, 2024 at 04:21:40 CEST napsal(a) Peter Schober via users:
> Peter Schober via users <users at shibboleth.net> [2024-07-08 16:15 CEST]:
> > I.e., remove the quotes around the space-separated list of attribute
> > names and it should work.

Thanks for advice.

Yes, this line is in the conf/ldap.properties file.

I've change it in this way:

idp.authn.LDAP.exportAttributes                  = uid cn eduPersonAffiliation eduPersonEntitlement eduPersonPrimaryOrgUnitDN eduPersonPrimaryAffiliation eduPersonOrgUnitDN sn ou givenName uidNumber businessCategory pager mail displayName

(removed quotes around and renamed expression).

and my definition of LDAP connector in the attribute-resolver.xml
is here:

<DataConnector id="myLDAP" xsi:type="LDAPDirectory"
    ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
    baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
    principal="%{idp.attribute.resolver.LDAP.bindDN}"
    principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
    useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
    connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
    responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
    connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"
    noResultIsError="true"
    multipleResultsIsError="true"
    excludeResolutionPhases="c14n/attribute"
    exportAttributes="%{idp.authn.LDAP.exportAttributes}">
    <FilterTemplate>
        <![CDATA[
            %{idp.attribute.resolver.LDAP.searchFilter}
        ]]>
    </FilterTemplate>
    <ConnectionPool
        minPoolSize="%{idp.pool.LDAP.minSize:3}"
        maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
        blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
        validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
        validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
        validateDN="%{idp.pool.LDAP.validateDN:}"
        validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
        validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"
        prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
        expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/>
</DataConnector>

And this solved my problem. It's simply works.

> 
> Also note that the attributes names to be listed as values for
> idp.authn.LDAP.returnAttributes should be separated by commas, not
> spaces.

I've found this page:

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631576/ReturnAttributes

where is written, that values have to be separated by spaces? Or
is somewhere another type of definition? I'm sorry, but I'm
sometimes confused... :-(

And other question: Where I can write
idp.authn.LDAP.returnAttributes in the definition of LDAP
connector? I've found another else definition, but it is
IMHO incompatible with my definition:

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631572/LDAPConnector

in the section Spring example?

> 
> I.e., the data structure you're using
> (idp.authn.LDAP.returnAttributes) is *incompatible* with the purpose
> you're trying to (mis-)use it for (exportAttributes expects a
> space-delimited list of attribute names).

Yes, you're right, but I was "blind"...

> 
> -peter

Sincerely
Jan
-- 
Ing. Jan Marek
University of South Bohemia
Academic Computer Centre
Phone: +420389032080
http://www.gnu.org/philosophy/no-word-attachments.cs.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20240709/d72e3130/attachment.sig>