Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[o haya]

Peter,

As mentioned earlier, the attribute-resolver.xml is the original one...
there is no "MyLDAP" in there.  I am on IdP V5.1.4.  I just found another
file in the conf/examples directory,
"conf/examples/attribute-resolver-ldap.xml".

Were you thinking that I had already copied that Are you saying that
"conf/examples/attribute-resolver-ldap.xml" file over the original
"conf/attribute-resolver.xml" file?

Should I copy that "conf/examples/attribute-resolver-ldap.xml" file to
replace the original "conf/attribute-resolver.xml" file (and then removed
that line with the "trustFile")?


Also, I have a separate question:  As mentioned, I am using an OpenDJ
LDAP.... the login for the LDAP is using "cn=Directory Manager", which I
have set in one of the properties in the ldap.properties file, but I'd been
wondering where the password for the "cn=Directory Manager" is supposed to
be set, and I think I just found that is be in the
/opt/shibboleth-idp/credentials/secrets.properties.

That secrets.properties file has:

# Default access to LDAP authn and attribute stores.
> idp.authn.LDAP.bindDNCredential              =myServicePassword
> idp.attribute.resolver.LDAP.bindDNCredential
> =%{idp.authn.LDAP.bindDNCredential:undefined}



I am *assuming* that I should put the password for the "cn=Directory
Manager" as the value for the 2nd line (i.e., replace the
"myServicePassword" with the password for the "cn=Directory Manager", but I
kind of unclear what to do to the 3rd line?  Should I also replace the
"undefined" with that same password value?

Sorry this is all probably kind of confusing :( !!

Jim





<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
Virus-free.www.avast.com
<https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail>
<#m_-7208505782941769154_DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

On Wed, Apr 9, 2025 at 2:54 PM Peter Schober via users <users at shibboleth.net>
wrote:

> o haya via users <users at shibboleth.net> [2025-04-09 17:10 CEST]:
> > currently I've configured the BEGINNING part of the Shib ldap properties:
> [...]
> > I have not changed anything in saml-nameid.xml or attribute-resolver.xml
> (I
> > did make changes which caused the IdP to fail to start earlier, but I've
> > since restored them to original).
>
> o haya via users <users at shibboleth.net> [2025-04-09 17:31 CEST]:
> > Here's what the SAMLResponse I am seeing looks like
> [...]
> >         <saml2:AttributeStatement>
> >             <saml2:Attribute FriendlyName="schacHomeOrganization"
> > Name="urn:oid:1.3.6.1.4.1.25178.1.2.9"
> > NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
> >                 <saml2:AttributeValue>xxxx.com</saml2:AttributeValue>
> >             </saml2:Attribute>
> >         </saml2:AttributeStatement>
> >     </saml2:Assertion>
> > </saml2p:Response>
>
> I don't see any questions in those two emails?
>
> If you're still asking "How do I get the example 'MyLDAP' Data
> Connector working with a non-TLS capable LDAP DSA" you've probably
> missed my previous reply pointing at the DataConnector's 'trustFile'
> parameter which will prevent that, no matter what you're setting in
> your ldap.properties.
>
> HTH,
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250409/a2ae4d5b/attachment.htm>