Thank you Ashok and Chad. It was LDAP configruation issue. I gave the wrong filter parameter. It is working fine now.<br><br>I have one more question, while configuring the LDAP connector we are forced to specify the "filterParameter". That is forcing us to get the attributes of a particular user. But is there any way to get the attributes of all the users that are present in LDAP hierarchy?<br>
<br>Thank you,<br>Naresh<br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 2:25 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
What's the value of USERNAME? I mean USERNAME should have enough privileges to get the value of $requestContext.principalName. Its kind of service account for LDAP. You may try with cn="Directory Manager" if you have the option.<br>
<div><br>Do you see the value of $requestContext.principalName in logs? Its the name of the user who is supposed to be authenticated.<br><br>I see there is no value coming for uid from LDAP in the logs which is $requestContext.principalName.<br>
<br>Thanks,<br><font color="#888888">-Ashok<br></font></div><div><div></div><div class="h5"><br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 1:58 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Here is my LDAP data connector configruation,<div><br><br><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br></div> ldapURL="ldap://<IP_ADDRESS>:389" <br>
<div> baseDN="ou=public,dc=abc,dc=com" <br>
principal="<USER_NAME>"<br> principalCredential="<PASSWORD>"><br> <dc:FilterTemplate><br> <![CDATA[<br> (uid=$requestContext.principalName)<br>
]]><br> </dc:FilterTemplate><br> </resolver:DataConnector><br><br><br></div>and here is the log<br><br><br>13:43:54.714 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter: (uid=<USERNAME>)<br>
13:43:54.714 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363] - LDAP data connector myLDAP - Retrieving attributes from LDAP<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the following parameters:<br>
13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - authtype = simple<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - dn =<USERNAME><br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] - credential = <suppressed><br>
13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with the following parameters:<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:194] - dn = ou=public,dc=abc,dc=com<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:195] - filter = (uid=<USERNAME>)<br>
13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:196] - filterArgs = []<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:197] - searchControls = javax.naming.directory.SearchControls@1c28517<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@1afe460, edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler@ba8fce, edu.vt.middleware.ldap.handler.BinarySearchResultHandler@3744bc]<br>
13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute uid containing 0 values<br>13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute mail for principal <USERNAME><br>
13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute mail containing 0 values<br>13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute transientId for principal <USERNAME><div>
<div></div><div><br>
<br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 1:52 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
How is your LDAP Data connector entry looks like in resolver.conf file? <br><br>Thanks,<br><font color="#888888">-Ashok</font><div><div></div><div><br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 1:38 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Thank you Ashok. IN the logs i am seeing the following messages,<br><br>Resolved attribute uid containing 0 values<br>
13:31:29.447 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute mail for principal pavank<br>
13:31:29.447 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute mail containing 0 values<br>13:31:29.447 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute transientId for principal pavank<br>
<br>I did not understand why it is not getting the value from LDAP. Is there configuration i am missing?<br><br>Thank you,<br><font color="#888888">Pavan</font><div><div></div><div><br><br><div class="gmail_quote">
On Tue, Aug 16, 2011 at 1:05 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">I think if you see the IdP access logs, it will tell you what attribute has been resolved and what are filtered. You may need to set the log level to debug to see all this.<br>
<br>Thanks,<br>-Ashok<br><br><br><div class="gmail_quote"><div><div></div><div>
On Tue, Aug 16, 2011 at 12:42 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div><div></div><div>
Hi All,<br><br>I am new to Shibboleth identity provider. I have installed and configured the Shibboleth identity provider by following the instructions given in shibboleth home page. I configured LDAP data connector to retrieve some attributes. And when i test the attribute resolver by using "AACLI" tool i am getting "No attribute statement" all the time. I did not find any logs related to attribute retrieval in the log files.<br>
<br>My configuration details as follows,<br><br><b>"handler.xml"</b><br><br><ph:LoginHandler xsi:type="ph:UsernamePassword" <br> jaasConfigurationLocation="file://IDP_HOME/conf/login.config"><br>
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod><br> </ph:LoginHandler> <br><br><b>"login.config"</b><br><br>edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
ldapUrl="LDAP_URL"<br> baseDn="ou=public,dc=abc,dc=com"<br> tls="true"<br> userFilter="uid={0}"<br> ;<br><br><b>"attribute-filter.xml"<br><br></b><afp:AttributeFilterPolicy><br>
<afp:PolicyRequirementRule xsi:type="basic:ANY" /><br><br> <afp:AttributeRule attributeID="mail"><br> <afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br> </afp:AttributeFilterPolicy><br><br><b>"attribute-resolver.xml"<br><br><br></b> <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail" sourceAttributeID="mail"><br>
<resolver:Dependency ref="myLDAP" /><br> <resolver:AttributeEncoder xsi:type="SAML2String"<br> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br> name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="mail" /> <br>
</resolver:AttributeDefinition><br><br><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br> ldapURL="LDAP_URL" <br> baseDN="ou=public,dc=abc,dc=com" <br>
principal="USER_NAME"<br> principalCredential="PASSWORD"><br> <dc:FilterTemplate><br> <![CDATA[<br> (uid=$requestContext.principalName)<br> ]]><br>
</dc:FilterTemplate><br> </resolver:DataConnector><b><br><br><br><br></b>Even when i comment the statements in "login.config" file, i am not getting any errors in the log file and still getting "No Aattribute Statement" message. Following is the command i am using from "IDP_HOME"<b><br>
<br>aacli.bat --configDir=../conf --principal=<USER_NAME><br><br></b>Could anyone please help me get this working? Am i missing something in the configruation? <br><br>Thank you in advance.<br><font color="#888888"><br>
-- Pavan<br>
</font><br></div></div>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><font color="#888888"><br><br clear="all"><br>-- <br>
<br><br><br><br><br><br>
</font><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><br><br><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>