Thank you Chad.<br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 3:09 PM, Chad La Joie <span dir="ltr"><<a href="mailto:lajoie@itumi.biz">lajoie@itumi.biz</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
No. The IdP is not a provisioning system.<br>
<div><div></div><div class="h5"><br>
On Tue, Aug 16, 2011 at 18:00, Pavan K <<a href="mailto:pavanonnet1986@gmail.com">pavanonnet1986@gmail.com</a>> wrote:<br>
> I don't want to deal with the database dump. I cannot do that in customer<br>
> environment. Is there any possibility in Shibboleth IDP?<br>
><br>
> Thank you,<br>
> Naresh<br>
><br>
> On Tue, Aug 16, 2011 at 2:57 PM, Ashok Kumar <<a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a>><br>
> wrote:<br>
>><br>
>><br>
>> On Tue, Aug 16, 2011 at 2:54 PM, Pavan K <<a href="mailto:pavanonnet1986@gmail.com">pavanonnet1986@gmail.com</a>> wrote:<br>
>>><br>
>>> Thank you Ashok.<br>
>>><br>
>>> I want to populate all the users from LDAP for a given basedn in my<br>
>>> application.<br>
>><br>
>> I would suggest to take a ldif dump from LDAP for a given basedn and dump<br>
>> in your application database.<br>
>><br>
>>><br>
>>> I tried to use "*" for filter but it did not work. It is throwing "size<br>
>>> limit exceeded" exception.<br>
>>><br>
>>> javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit<br>
>>> Exceeded]<br>
>>> at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)<br>
>>> ~[na:1.6.0_06]<br>
>>> at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)<br>
>>> ~[na:1.6.0_06]<br>
>>> at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)<br>
>>> ~[na:1.6.0_06]<br>
>>><br>
>>><br>
>>> On Tue, Aug 16, 2011 at 2:45 PM, Ashok Kumar <<a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a>><br>
>>> wrote:<br>
>>>><br>
>>>> Hmm... If you are trying to find all the users along with all their<br>
>>>> attributes & values, then you may try filter uid=* in data connector. I have<br>
>>>> not used before from IdP but using ldapsearch on LDAP, it will give you all<br>
>>>> the entries requested on a specific basedn.<br>
>>>><br>
>>>> What are you trying to achieve out of it?<br>
>>>><br>
>>>> On Tue, Aug 16, 2011 at 2:34 PM, Pavan K <<a href="mailto:pavanonnet1986@gmail.com">pavanonnet1986@gmail.com</a>><br>
>>>> wrote:<br>
>>>>><br>
>>>>> Thank you Ashok and Chad. It was LDAP configruation issue. I gave the<br>
>>>>> wrong filter parameter. It is working fine now.<br>
>>>>><br>
>>>>> I have one more question, while configuring the LDAP connector we are<br>
>>>>> forced to specify the "filterParameter". That is forcing us to get the<br>
>>>>> attributes of a particular user. But is there any way to get the attributes<br>
>>>>> of all the users that are present in LDAP hierarchy?<br>
>>>>><br>
>>>>> Thank you,<br>
>>>>> Naresh<br>
>>>>><br>
>>>>> On Tue, Aug 16, 2011 at 2:25 PM, Ashok Kumar<br>
>>>>> <<a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a>> wrote:<br>
>>>>>><br>
>>>>>> What's the value of USERNAME? I mean USERNAME should have enough<br>
>>>>>> privileges to get the value of $requestContext.principalName. Its kind of<br>
>>>>>> service account for LDAP. You may try with cn="Directory Manager" if you<br>
>>>>>> have the option.<br>
>>>>>><br>
>>>>>> Do you see the value of $requestContext.principalName in logs? Its the<br>
>>>>>> name of the user who is supposed to be authenticated.<br>
>>>>>><br>
>>>>>> I see there is no value coming for uid from LDAP in the logs which is<br>
>>>>>> $requestContext.principalName.<br>
>>>>>><br>
>>>>>> Thanks,<br>
>>>>>> -Ashok<br>
>>>>>><br>
>>>>>><br>
>>>>>> On Tue, Aug 16, 2011 at 1:58 PM, Pavan K <<a href="mailto:pavanonnet1986@gmail.com">pavanonnet1986@gmail.com</a>><br>
>>>>>> wrote:<br>
>>>>>>><br>
>>>>>>> Here is my LDAP data connector configruation,<br>
>>>>>>><br>
>>>>>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br>
>>>>>>> ldapURL="ldap://<IP_ADDRESS>:389"<br>
>>>>>>> baseDN="ou=public,dc=abc,dc=com"<br>
>>>>>>> principal="<USER_NAME>"<br>
>>>>>>> principalCredential="<PASSWORD>"><br>
>>>>>>> <dc:FilterTemplate><br>
>>>>>>> <![CDATA[<br>
>>>>>>> (uid=$requestContext.principalName)<br>
>>>>>>> ]]><br>
>>>>>>> </dc:FilterTemplate><br>
>>>>>>> </resolver:DataConnector><br>
>>>>>>><br>
>>>>>>><br>
>>>>>>> and here is the log<br>
>>>>>>><br>
>>>>>>><br>
>>>>>>> 13:43:54.714 - DEBUG<br>
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308]<br>
>>>>>>> - Search filter: (uid=<USERNAME>)<br>
>>>>>>> 13:43:54.714 - DEBUG<br>
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363]<br>
>>>>>>> - LDAP data connector myLDAP - Retrieving attributes from LDAP<br>
>>>>>>> 13:43:54.714 - DEBUG<br>
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the<br>
>>>>>>> following parameters:<br>
>>>>>>> 13:43:54.714 - DEBUG<br>
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - authtype =<br>
>>>>>>> simple<br>
>>>>>>> 13:43:54.714 - DEBUG<br>
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - dn<br>
>>>>>>> =<USERNAME><br>
>>>>>>> 13:43:54.714 - DEBUG<br>
>>>>>>> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] - credential<br>
>>>>>>> = <suppressed><br>
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with<br>
>>>>>>> the following parameters:<br>
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:194] - dn =<br>
>>>>>>> ou=public,dc=abc,dc=com<br>
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:195] - filter =<br>
>>>>>>> (uid=<USERNAME>)<br>
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:196] - filterArgs<br>
>>>>>>> = []<br>
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:197] -<br>
>>>>>>> searchControls = javax.naming.directory.SearchControls@1c28517<br>
>>>>>>> 13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:198] - handler =<br>
>>>>>>> [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@1afe460,<br>
>>>>>>> edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler@ba8fce,<br>
>>>>>>> edu.vt.middleware.ldap.handler.BinarySearchResultHandler@3744bc]<br>
>>>>>>> 13:43:54.730 - DEBUG<br>
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]<br>
>>>>>>> - Resolved attribute uid containing 0 values<br>
>>>>>>> 13:43:54.730 - DEBUG<br>
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]<br>
>>>>>>> - Resolving attribute mail for principal <USERNAME><br>
>>>>>>> 13:43:54.730 - DEBUG<br>
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]<br>
>>>>>>> - Resolved attribute mail containing 0 values<br>
>>>>>>> 13:43:54.730 - DEBUG<br>
>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]<br>
>>>>>>> - Resolving attribute transientId for principal <USERNAME><br>
>>>>>>><br>
>>>>>>><br>
>>>>>>> On Tue, Aug 16, 2011 at 1:52 PM, Ashok Kumar<br>
>>>>>>> <<a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a>> wrote:<br>
>>>>>>>><br>
>>>>>>>> How is your LDAP Data connector entry looks like in resolver.conf<br>
>>>>>>>> file?<br>
>>>>>>>><br>
>>>>>>>> Thanks,<br>
>>>>>>>> -Ashok<br>
>>>>>>>><br>
>>>>>>>> On Tue, Aug 16, 2011 at 1:38 PM, Pavan K <<a href="mailto:pavanonnet1986@gmail.com">pavanonnet1986@gmail.com</a>><br>
>>>>>>>> wrote:<br>
>>>>>>>>><br>
>>>>>>>>> Thank you Ashok. IN the logs i am seeing the following messages,<br>
>>>>>>>>><br>
>>>>>>>>> Resolved attribute uid containing 0 values<br>
>>>>>>>>> 13:31:29.447 - DEBUG<br>
>>>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]<br>
>>>>>>>>> - Resolving attribute mail for principal pavank<br>
>>>>>>>>> 13:31:29.447 - DEBUG<br>
>>>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336]<br>
>>>>>>>>> - Resolved attribute mail containing 0 values<br>
>>>>>>>>> 13:31:29.447 - DEBUG<br>
>>>>>>>>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314]<br>
>>>>>>>>> - Resolving attribute transientId for principal pavank<br>
>>>>>>>>><br>
>>>>>>>>> I did not understand why it is not getting the value from LDAP. Is<br>
>>>>>>>>> there configuration i am missing?<br>
>>>>>>>>><br>
>>>>>>>>> Thank you,<br>
>>>>>>>>> Pavan<br>
>>>>>>>>><br>
>>>>>>>>> On Tue, Aug 16, 2011 at 1:05 PM, Ashok Kumar<br>
>>>>>>>>> <<a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a>> wrote:<br>
>>>>>>>>>><br>
>>>>>>>>>> I think if you see the IdP access logs, it will tell you what<br>
>>>>>>>>>> attribute has been resolved and what are filtered. You may need to set the<br>
>>>>>>>>>> log level to debug to see all this.<br>
>>>>>>>>>><br>
>>>>>>>>>> Thanks,<br>
>>>>>>>>>> -Ashok<br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> On Tue, Aug 16, 2011 at 12:42 PM, Pavan K<br>
>>>>>>>>>> <<a href="mailto:pavanonnet1986@gmail.com">pavanonnet1986@gmail.com</a>> wrote:<br>
>>>>>>>>>>><br>
>>>>>>>>>>> Hi All,<br>
>>>>>>>>>>><br>
>>>>>>>>>>> I am new to Shibboleth identity provider. I have installed and<br>
>>>>>>>>>>> configured the Shibboleth identity provider by following the instructions<br>
>>>>>>>>>>> given in shibboleth home page. I configured LDAP data connector to retrieve<br>
>>>>>>>>>>> some attributes. And when i test the attribute resolver by using "AACLI"<br>
>>>>>>>>>>> tool i am getting "No attribute statement" all the time. I did not find any<br>
>>>>>>>>>>> logs related to attribute retrieval in the log files.<br>
>>>>>>>>>>><br>
>>>>>>>>>>> My configuration details as follows,<br>
>>>>>>>>>>><br>
>>>>>>>>>>> "handler.xml"<br>
>>>>>>>>>>><br>
>>>>>>>>>>> <ph:LoginHandler xsi:type="ph:UsernamePassword"<br>
>>>>>>>>>>><br>
>>>>>>>>>>> jaasConfigurationLocation="file://IDP_HOME/conf/login.config"><br>
>>>>>>>>>>><br>
>>>>>>>>>>> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod><br>
>>>>>>>>>>> </ph:LoginHandler><br>
>>>>>>>>>>><br>
>>>>>>>>>>> "login.config"<br>
>>>>>>>>>>><br>
>>>>>>>>>>> edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
>>>>>>>>>>> ldapUrl="LDAP_URL"<br>
>>>>>>>>>>> baseDn="ou=public,dc=abc,dc=com"<br>
>>>>>>>>>>> tls="true"<br>
>>>>>>>>>>> userFilter="uid={0}"<br>
>>>>>>>>>>> ;<br>
>>>>>>>>>>><br>
>>>>>>>>>>> "attribute-filter.xml"<br>
>>>>>>>>>>><br>
>>>>>>>>>>> <afp:AttributeFilterPolicy><br>
>>>>>>>>>>> <afp:PolicyRequirementRule xsi:type="basic:ANY" /><br>
>>>>>>>>>>><br>
>>>>>>>>>>> <afp:AttributeRule attributeID="mail"><br>
>>>>>>>>>>> <afp:PermitValueRule xsi:type="basic:ANY" /><br>
>>>>>>>>>>> </afp:AttributeRule><br>
>>>>>>>>>>> </afp:AttributeFilterPolicy><br>
>>>>>>>>>>><br>
>>>>>>>>>>> "attribute-resolver.xml"<br>
>>>>>>>>>>><br>
>>>>>>>>>>><br>
>>>>>>>>>>> <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail"<br>
>>>>>>>>>>> sourceAttributeID="mail"><br>
>>>>>>>>>>> <resolver:Dependency ref="myLDAP" /><br>
>>>>>>>>>>> <resolver:AttributeEncoder xsi:type="SAML2String"<br>
>>>>>>>>>>> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
>>>>>>>>>>> name="urn:oid:0.9.2342.19200300.100.1.1"<br>
>>>>>>>>>>> friendlyName="mail" /><br>
>>>>>>>>>>> </resolver:AttributeDefinition><br>
>>>>>>>>>>><br>
>>>>>>>>>>> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br>
>>>>>>>>>>> ldapURL="LDAP_URL"<br>
>>>>>>>>>>> baseDN="ou=public,dc=abc,dc=com"<br>
>>>>>>>>>>> principal="USER_NAME"<br>
>>>>>>>>>>> principalCredential="PASSWORD"><br>
>>>>>>>>>>> <dc:FilterTemplate><br>
>>>>>>>>>>> <![CDATA[<br>
>>>>>>>>>>> (uid=$requestContext.principalName)<br>
>>>>>>>>>>> ]]><br>
>>>>>>>>>>> </dc:FilterTemplate><br>
>>>>>>>>>>> </resolver:DataConnector><br>
>>>>>>>>>>><br>
>>>>>>>>>>><br>
>>>>>>>>>>><br>
>>>>>>>>>>> Even when i comment the statements in "login.config" file, i am<br>
>>>>>>>>>>> not getting any errors in the log file and still getting "No Aattribute<br>
>>>>>>>>>>> Statement" message. Following is the command i am using from "IDP_HOME"<br>
>>>>>>>>>>><br>
>>>>>>>>>>> aacli.bat --configDir=../conf --principal=<USER_NAME><br>
>>>>>>>>>>><br>
>>>>>>>>>>> Could anyone please help me get this working? Am i missing<br>
>>>>>>>>>>> something in the configruation?<br>
>>>>>>>>>>><br>
>>>>>>>>>>> Thank you in advance.<br>
>>>>>>>>>>><br>
>>>>>>>>>>> -- Pavan<br>
>>>>>>>>>>><br>
>>>>>>>>>>> --<br>
>>>>>>>>>>> To unsubscribe from this list send an email to<br>
>>>>>>>>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> --<br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>><br>
>>>>>>>>>> --<br>
>>>>>>>>>> To unsubscribe from this list send an email to<br>
>>>>>>>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>>>>>>>><br>
>>>>>>>>><br>
>>>>>>>>> --<br>
>>>>>>>>> To unsubscribe from this list send an email to<br>
>>>>>>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>> --<br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>><br>
>>>>>>>> --<br>
>>>>>>>> To unsubscribe from this list send an email to<br>
>>>>>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>>>>>><br>
>>>>>>><br>
>>>>>>> --<br>
>>>>>>> To unsubscribe from this list send an email to<br>
>>>>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>>>>><br>
>>>>>><br>
>>>>>><br>
>>>>>><br>
>>>>>><br>
>>>>>> --<br>
>>>>>> To unsubscribe from this list send an email to<br>
>>>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>>>><br>
>>>>><br>
>>>>> --<br>
>>>>> To unsubscribe from this list send an email to<br>
>>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>>><br>
>>>><br>
>>>><br>
>>>> --<br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>><br>
>>>> -Ashok Kumar<br>
>>>> CSUEB<br>
>>>> Email: <a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a><br>
>>>> Phone: <a href="tel:510-885-2141" value="+15108852141">510-885-2141</a><br>
>>>><br>
>>>><br>
>>>> --<br>
>>>> To unsubscribe from this list send an email to<br>
>>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>>><br>
>>><br>
>>> --<br>
>>> To unsubscribe from this list send an email to<br>
>>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
>><br>
>><br>
>><br>
>> --<br>
>><br>
>><br>
>><br>
>><br>
>><br>
>> -Ashok Kumar<br>
>> CSUEB<br>
>> Email: <a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a><br>
>> Phone: <a href="tel:510-885-2141" value="+15108852141">510-885-2141</a><br>
>><br>
>><br>
>> --<br>
>> To unsubscribe from this list send an email to<br>
>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
> --<br>
> To unsubscribe from this list send an email to<br>
> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
<br>
<br>
<br>
--<br>
</div></div><div class="im">Chad La Joie<br>
<a href="http://www.itumi.biz" target="_blank">www.itumi.biz</a><br>
trusted identities, delivered<br>
--<br>
</div><div><div></div><div class="h5">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>