Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[o haya]

Hi Scott and Peter!!

I really appreciate your responses/comments, especially Scott's comments
about the attribute resolver... it is a LOT of information, especially
conceptually, to digest for a newbie and the "glue" to the different pieces
of information is the hardest part to try to understand.  I mean I feel
like I have a LOT of experience with federation, LDAPs, etc., but most of
my work has been with COTS products, and some of the concepts in Shibboleth
are still a little new to me, so it is taking a while for me.

I think that I am kind of a "learn by doing" type person, so, personally,
it is important in my learning process to get something, even something
simple, working, and then I can go from there, so that is currently what I
am trying to get to/achieve.  Even if I can get just one of 2 attributes
and mainly, the nameid part working, that would be a great starting point.

As far as specifics, as mentioned, I am using OpenDJ (I tend to use OpenDJ
in development, because it includes a control panel for administration,
plus a standalone LDAP instance, in one package, but I have used Oracle
OUD, AD, and even the old Oracle OID and the original SunDS, for years).
OpenDJ includes a standard LDAP schema, similar to SunDS, I think, and
currently I've configured the BEGINNING part of the Shib ldap properties:

==================================================================================

# LDAP authentication (and possibly attribute resolver) configuration
# Note, this doesn't apply to the use of JAAS authentication via LDAP

## Authenticator strategy, either anonSearchAuthenticator,
bindSearchAuthenticator, directAuthenticator, adAuthenticator
idp.authn.LDAP.authenticator                   = anonSearchAuthenticator

## Connection properties ##
idp.authn.LDAP.ldapURL                          = ldap://localhost:1389
idp.authn.LDAP.useStartTLS                     = false
# Time to wait for startTLS responses
#idp.authn.LDAP.startTLSTimeout                 = PT3S
# Time to wait for connections to open
#idp.authn.LDAP.connectTimeout                  = PT3S
# Time to wait for operation responses (e.g. search, bind)
#idp.authn.LDAP.responseTimeout                 = PT3S
# Connection strategy to use when multiple URLs are supplied, either
ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM
#idp.authn.LDAP.connectionStrategy               = ACTIVE_PASSIVE

## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust
#idp.authn.LDAP.sslConfig                       = certificateTrust
## If using certificateTrust above, set to the trusted certificate's path
#idp.authn.LDAP.trustCertificates                =
%{idp.home}/credentials/ldap-server.crt
## If using keyStoreTrust above, set to the truststore path
#idp.authn.LDAP.trustStore                       =
%{idp.home}/credentials/ldap-server.truststore

## Return attributes during authentication
# Setting this property will cause entry resolution to occur as part of
authentication
# Note that this property is not compatible with the adAuthenticator
#idp.authn.LDAP.returnAttributes                 =
passwordExpirationTime,loginGraceRemaining

## DN resolution properties ##

# Search DN resolution, used by anonSearchAuthenticator,
bindSearchAuthenticator
# for AD: CN=Users,DC=example,DC=org
idp.authn.LDAP.baseDN                           = ou=people,dc=xxxx,dc=com
idp.authn.LDAP.subtreeSearch                   = true
idp.authn.LDAP.userFilter                       = (cn={user})
# bind search configuration
# for AD: idp.authn.LDAP.bindDN=adminuser at domain.com
idp.authn.LDAP.bindDN                           = cn=directory manager

# Format DN resolution, used by directAuthenticator, adAuthenticator
# for AD use idp.authn.LDAP.dnFormat=%s at domain.com
idp.authn.LDAP.dnFormat                         =
cn=%s,ou=people,dc=xxxx,dc=com

===========================================================================



I have not changed anything in saml-nameid.xml or attribute-resolver.xml (I
did make changes which caused the IdP to fail to start earlier, but I've
since restored them to original).

Jim



<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Wed, Apr 9, 2025 at 8:37 AM Cantor, Scott via users <users at shibboleth.net>
wrote:

> > I was seeing errors in the idp-warn.log about missing >
> > certificat  (.crt) files, even though I have TLS set to 'false' in
> > the ldap.properties file.
>
> That's doesn't mean you're not applying other settings that assume they
> exist.
>
> But using ldap:// instead of ldaps:// with the startTLS setting off should
> not result in actual use of TLS in either of the two ways it gets used.
> jvmTrust is probably a reasonable fallback option to set when not using TLS
> at all since it shouldn't matter and doesn't require additional setup.
>
> As for the documentation, I don't think the resolver material is
> approachable, it doesn't explain any concepts. A section outlining what
> it's really doing and how the connectors and definitions get applied is
> needed.
>
> Having said which, the LDAP data connector topic should be all anybody
> needs to set up a query, not to mention there's a specific example file in
> the install for LDAP.
>
> But as for the NameID generation matetrial: that is as good as it's ever
> going to get IMHO.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250409/7db25f4a/attachment.htm>