Question about Scripted attribute in attribute-resolver.xml

[Emilie Boulard]

Hello Peter, 

Thanks for your answer, it's reaaly helpful.

I will look further into the multiple ldap connector then, i think i had misconfigured the second one when trying and that resulted in impacting my authentification I used separate filter and DN and it was defined in the ldap.properties, i used this documentation page: https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration#Aggregate-DN-Resolver and i think this is why i didn't go in the right direction. I will dig into this page https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631572/LDAPConnector to try to make a decent second data connector. 

As for your suggestion for the renater federation, the SP i try to configure is not using the Renater Federation, it is for SSO authentification with LDAP on a specific software (it's the only one for now, the rest of our SP are using federation indeed).

Thanks again and have a nice day, 

Emilie

----- Mail original -----
De: "Peter Schober via users" <users at shibboleth.net>
À: "users" <users at shibboleth.net>
Cc: "Peter Schober" <peter.schober at univie.ac.at>
Envoyé: Vendredi 1 Mars 2024 11:12:15
Objet: Re: Question about Scripted attribute in attribute-resolver.xml

Emilie Boulard <boulard at cines.fr> [2024-03-01 10:31 CET]:
> I did initially though of using a secondary DN in the
> ldap.properties so i could access to the right ldap attribute in the
> correct OU.

FYI, you don't have to use properties for anything.  Those just allow
you to keep some information outside of the XML if you wanted.

> But when trying that i realised it was impacting authentification
> and that's not what i want. Our users must identify whith their ldap
> login.

You can add multiple LDAP DataConnectors and doing should NOT affect
authentication. Seems to me that fixing whatever you've done here
should avoid any of the highly complex things you were speculating
about (looking up system groups, running local executables from Java,
etc.)

As CINES is a member of Fédération Éducation-Recherche I would suggest
talking to RENATER.fr about your situation and what you're trying to
achieve.

Best regards,
-peter
-- 
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net