Question about Scripted attribute in attribute-resolver.xml

[Emilie Boulard]

Yeah, i totally made a mistake by using the wrong wiki page. 
It was because i thought at the time that the data connector and the ldapauth was mandatory related. Like i said, i am very new to Shibboleth, sorry for that.

Anyways, thanks a lot to both of you for your explanations with Scott, i think i understand a bit better.

Maybe i have restricted my domain search a bit too much in my idp.attribute.resolver.LDAP.baseDN because i configure it to just acces the OU "people" and the OU "GroupPosix" is not included in that. This is why when i tried to made another DataConnector i configured a idp.attribute.resolver.LDAP.baseDN2.

I will test what you have kindly suggested and look thouroughly the documentations pages you have pointed.

Thanks a lot again for your patience and help!

Emilie

----- Mail original -----
De: "Peter Schober via users" <users at shibboleth.net>
À: "Shib Users" <users at shibboleth.net>
Cc: "Peter Schober" <peter.schober at univie.ac.at>
Envoyé: Vendredi 1 Mars 2024 12:30:21
Objet: Re: Question about Scripted attribute in attribute-resolver.xml

Emilie Boulard <boulard at cines.fr> [2024-03-01 11:28 CET]:
> I will look further into the multiple ldap connector then, i think i
> had misconfigured the second one when trying and that resulted in
> impacting my authentification I used separate filter and DN and it
> was defined in the ldap.properties, i used this documentation page:
> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631612/LDAPAuthnConfiguration#Aggregate-DN-Resolver
> and i think this is why i didn't go in the right direction.

Well, for starters the name of that page is LDAPAuthnConfiguration and
your question was not about authentication -- it was about getting
back a gidNumber and translating that gidNumber into the group's
name, no?
You should be able to look up the cn of the LDAP posixGroup object
based on the already already resolved gidNumber (from the user
object), maybe something like this (completely untested):

<DataConnector id="myLDAPGroup" xsi:type="LDAPDirectory" exportAttributes="groupName"
  ... etc ...
  <FilterTemplate>
    <![CDATA[
      (&(objectClass=posixGroup)(gidNumber=$gidNumber.get(0)))
    ]]>
  <ReturnAttributes>cn</ReturnAttributes>
  <Column columnName="cn" attributeID="groupName" />
  <InputAttributeDefinition ref="gidNumber" />
</DataConnector>

gidNumber is single-valued in RFC 2307 so each user would only have
one gidNumber value and therefore you'd only get back a single group
name for each user, making the above sufficient, I think.

The above should give you an IDP attribute named "groupName" (and
without needing an AttributeDefinition for it) containing the CN of
the posixGroup for a given gidNumber. See the docs for more:
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631572/LDAPConnector
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631576/ReturnAttributes
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631574/FilterTemplate

N.B.: Depending on your LDAP server implementation and configuration
you may also have other strategies available to get group memberships
(e.g. static groups with groupOfNames, possibly with lookup of those
groups from operational attributes on the user object via memberOf).

> As for your suggestion for the renater federation, the SP i try to
> configure is not using the Renater Federation, it is for SSO
> authentification with LDAP on a specific software (it's the only one
> for now, the rest of our SP are using federation indeed).

All your questions here so far were about configuring the IDP and
getting a few attributes released. The fact that the SP you may
ultimately be doing this for is not a federation member itself should
not factor into this at all.
(I can't speak for the folks at RENATER, of course, but in our local
federation you'd get the same amount and quality of support no matter
whether you're trying to integrate with another federation member's
service  or with something else.)

Best,
-peter
-- 
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net