Question about Scripted attribute in attribute-resolver.xml

[Peter Schober]

Emilie Boulard <boulard at cines.fr> [2024-03-01 11:28 CET]:
> I will look further into the multiple ldap connector then, i think i
> had misconfigured the second one when trying and that resulted in
> impacting my authentification I used separate filter and DN and it
> was defined in the ldap.properties, i used this documentation page:
> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration#Aggregate-DN-Resolver
> and i think this is why i didn't go in the right direction.

Well, for starters the name of that page is LDAPAuthnConfiguration and
your question was not about authentication -- it was about getting
back a gidNumber and translating that gidNumber into the group's
name, no?
You should be able to look up the cn of the LDAP posixGroup object
based on the already already resolved gidNumber (from the user
object), maybe something like this (completely untested):

<DataConnector id="myLDAPGroup" xsi:type="LDAPDirectory" exportAttributes="groupName"
  ... etc ...
  <FilterTemplate>
    <![CDATA[
      (&(objectClass=posixGroup)(gidNumber=$gidNumber.get(0)))
    ]]>
  <ReturnAttributes>cn</ReturnAttributes>
  <Column columnName="cn" attributeID="groupName" />
  <InputAttributeDefinition ref="gidNumber" />
</DataConnector>

gidNumber is single-valued in RFC 2307 so each user would only have
one gidNumber value and therefore you'd only get back a single group
name for each user, making the above sufficient, I think.

The above should give you an IDP attribute named "groupName" (and
without needing an AttributeDefinition for it) containing the CN of
the posixGroup for a given gidNumber. See the docs for more:
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631572/LDAPConnector
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631576/ReturnAttributes
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631574/FilterTemplate

N.B.: Depending on your LDAP server implementation and configuration
you may also have other strategies available to get group memberships
(e.g. static groups with groupOfNames, possibly with lookup of those
groups from operational attributes on the user object via memberOf).

> As for your suggestion for the renater federation, the SP i try to
> configure is not using the Renater Federation, it is for SSO
> authentification with LDAP on a specific software (it's the only one
> for now, the rest of our SP are using federation indeed).

All your questions here so far were about configuring the IDP and
getting a few attributes released. The fact that the SP you may
ultimately be doing this for is not a federation member itself should
not factor into this at all.
(I can't speak for the folks at RENATER, of course, but in our local
federation you'd get the same amount and quality of support no matter
whether you're trying to integrate with another federation member's
service  or with something else.)

Best,
-peter