Shibboleth IdP is partially working with LDAP, but SAMLResponse NameID (and attributes) are missing

[Peter Schober]

o haya via users <users at shibboleth.net> [2025-04-09 23:57 CEST]:
> Were you thinking that I had already copied that Are you saying that
> "conf/examples/attribute-resolver-ldap.xml" file over the original
> "conf/attribute-resolver.xml" file?

I'd start with LDAP by copying over the DataConnector from the
provided example file, yes. That's what the example files are for.
Then also copy over one of the AttributeDefinitions and adapt that to
match what's in your LDAP DSA.

> Also, I have a separate question:  As mentioned, I am using an OpenDJ
> LDAP.... the login for the LDAP is using "cn=Directory Manager"

Which is irrelevant at this point as you've configured the
anonSearchAuthenticator. (Or that's default, then you have not yet
configured the bindSearchAuthenticator that would perform a bind
first.)

> which I
> have set in one of the properties in the ldap.properties file, but I'd been
> wondering where the password for the "cn=Directory Manager" is supposed to
> be set, and I think I just found that is be in the
> /opt/shibboleth-idp/credentials/secrets.properties.

Yup.

> That secrets.properties file has:
> 
> # Default access to LDAP authn and attribute stores.
> > idp.authn.LDAP.bindDNCredential              =myServicePassword
> > idp.attribute.resolver.LDAP.bindDNCredential =%{idp.authn.LDAP.bindDNCredential:undefined}
> 
> I am *assuming* that I should put the password for the "cn=Directory
> Manager" as the value for the 2nd line (i.e., replace the
> "myServicePassword" with the password for the "cn=Directory Manager", but I
> kind of unclear what to do to the 3rd line?  Should I also replace the
> "undefined" with that same password value?

Java properties can reference other Java properties (which is why when
you replace "myServicePassword" in the 1st line above it'll also be
set for the 2nd line above).
Furthermore, they can have default/fallback values so that they are
not undefined when no value has been set (2nd line, after the colon).
Ignore that part for now and just set the password for your bind user
in the 1st line.

-peter