Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Cantor, Scott]

> I was seeing errors in the idp-warn.log about missing > 
> certificat  (.crt) files, even though I have TLS set to 'false' in 
> the ldap.properties file.

That's doesn't mean you're not applying other settings that assume they exist.

But using ldap:// instead of ldaps:// with the startTLS setting off should not result in actual use of TLS in either of the two ways it gets used. jvmTrust is probably a reasonable fallback option to set when not using TLS at all since it shouldn't matter and doesn't require additional setup.

As for the documentation, I don't think the resolver material is approachable, it doesn't explain any concepts. A section outlining what it's really doing and how the connectors and definitions get applied is needed.

Having said which, the LDAP data connector topic should be all anybody needs to set up a query, not to mention there's a specific example file in the install for LDAP.

But as for the NameID generation matetrial: that is as good as it's ever going to get IMHO.

-- Scott