I don't want to deal with the database dump. I cannot do that in customer environment. Is there any possibility in Shibboleth IDP?<br><br>Thank you,<br>Naresh<br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 2:57 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu">ashok.kumar@csueastbay.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><br><br><div class="gmail_quote"><div class="im">On Tue, Aug 16, 2011 at 2:54 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Thank you Ashok.<br><br>I want to populate all the users from LDAP for a given basedn in my application.<br></blockquote></div><div><br>I would suggest to take a ldif dump from LDAP for a given basedn and dump in your application database.<br>
</div><div><div></div><div class="h5"><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><br>I tried to use "*" for filter but it did not work. It is throwing "size limit exceeded" exception. <br>
<br>javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit Exceeded]<br> at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) ~[na:1.6.0_06]<br> at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) ~[na:1.6.0_06]<br>
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) ~[na:1.6.0_06]<div><div></div><div><br><br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 2:45 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Hmm... If you are trying to find all the users along with all their attributes & values, then you may try filter uid=* in data connector. I have not used before from IdP but using ldapsearch on LDAP, it will give you all the entries requested on a specific basedn.<br>
<br>What are you trying to achieve out of it?<div><div></div><div><br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 2:34 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Thank you Ashok and Chad. It was LDAP configruation issue. I gave the wrong filter parameter. It is working fine now.<br>
<br>I have one more question, while configuring the LDAP connector we are forced to specify the "filterParameter". That is forcing us to get the attributes of a particular user. But is there any way to get the attributes of all the users that are present in LDAP hierarchy?<br>
<br>Thank you,<br>Naresh<div><div></div><div><br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 2:25 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
What's the value of USERNAME? I mean USERNAME should have enough privileges to get the value of $requestContext.principalName. Its kind of service account for LDAP. You may try with cn="Directory Manager" if you have the option.<br>
<div><br>Do you see the value of $requestContext.principalName in logs? Its the name of the user who is supposed to be authenticated.<br><br>I see there is no value coming for uid from LDAP in the logs which is $requestContext.principalName.<br>
<br>Thanks,<br><font color="#888888">-Ashok<br></font></div><div><div></div><div><br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 1:58 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Here is my LDAP data connector configruation,<div><br><br><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br></div> ldapURL="ldap://<IP_ADDRESS>:389" <br>
<div> baseDN="ou=public,dc=abc,dc=com" <br>
principal="<USER_NAME>"<br> principalCredential="<PASSWORD>"><br> <dc:FilterTemplate><br> <![CDATA[<br> (uid=$requestContext.principalName)<br>
]]><br> </dc:FilterTemplate><br> </resolver:DataConnector><br><br><br></div>and here is the log<br><br><br>13:43:54.714 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter: (uid=<USERNAME>)<br>
13:43:54.714 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:363] - LDAP data connector myLDAP - Retrieving attributes from LDAP<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the following parameters:<br>
13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - authtype = simple<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - dn =<USERNAME><br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] - credential = <suppressed><br>
13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:193] - Search with the following parameters:<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:194] - dn = ou=public,dc=abc,dc=com<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:195] - filter = (uid=<USERNAME>)<br>
13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:196] - filterArgs = []<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:197] - searchControls = javax.naming.directory.SearchControls@1c28517<br>13:43:54.714 - DEBUG [edu.vt.middleware.ldap.Ldap:198] - handler = [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler@1afe460, edu.vt.middleware.ldap.handler.EntryDnSearchResultHandler@ba8fce, edu.vt.middleware.ldap.handler.BinarySearchResultHandler@3744bc]<br>
13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute uid containing 0 values<br>13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute mail for principal <USERNAME><br>
13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute mail containing 0 values<br>13:43:54.730 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute transientId for principal <USERNAME><div>
<div></div><div><br>
<br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 1:52 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
How is your LDAP Data connector entry looks like in resolver.conf file? <br><br>Thanks,<br><font color="#888888">-Ashok</font><div><div></div><div><br><br><div class="gmail_quote">On Tue, Aug 16, 2011 at 1:38 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">Thank you Ashok. IN the logs i am seeing the following messages,<br><br>Resolved attribute uid containing 0 values<br>
13:31:29.447 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute mail for principal pavank<br>
13:31:29.447 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:336] - Resolved attribute mail containing 0 values<br>13:31:29.447 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:314] - Resolving attribute transientId for principal pavank<br>
<br>I did not understand why it is not getting the value from LDAP. Is there configuration i am missing?<br><br>Thank you,<br><font color="#888888">Pavan</font><div><div></div><div><br><br><div class="gmail_quote">
On Tue, Aug 16, 2011 at 1:05 PM, Ashok Kumar <span dir="ltr"><<a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">I think if you see the IdP access logs, it will tell you what attribute has been resolved and what are filtered. You may need to set the log level to debug to see all this.<br>
<br>Thanks,<br>-Ashok<br><br><br><div class="gmail_quote"><div><div></div><div>
On Tue, Aug 16, 2011 at 12:42 PM, Pavan K <span dir="ltr"><<a href="mailto:pavanonnet1986@gmail.com" target="_blank">pavanonnet1986@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div><div></div><div>
Hi All,<br><br>I am new to Shibboleth identity provider. I have installed and configured the Shibboleth identity provider by following the instructions given in shibboleth home page. I configured LDAP data connector to retrieve some attributes. And when i test the attribute resolver by using "AACLI" tool i am getting "No attribute statement" all the time. I did not find any logs related to attribute retrieval in the log files.<br>
<br>My configuration details as follows,<br><br><b>"handler.xml"</b><br><br><ph:LoginHandler xsi:type="ph:UsernamePassword" <br> jaasConfigurationLocation="file://IDP_HOME/conf/login.config"><br>
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod><br> </ph:LoginHandler> <br><br><b>"login.config"</b><br><br>edu.vt.middleware.ldap.jaas.LdapLoginModule required<br>
ldapUrl="LDAP_URL"<br> baseDn="ou=public,dc=abc,dc=com"<br> tls="true"<br> userFilter="uid={0}"<br> ;<br><br><b>"attribute-filter.xml"<br><br></b><afp:AttributeFilterPolicy><br>
<afp:PolicyRequirementRule xsi:type="basic:ANY" /><br><br> <afp:AttributeRule attributeID="mail"><br> <afp:PermitValueRule xsi:type="basic:ANY" /><br>
</afp:AttributeRule><br> </afp:AttributeFilterPolicy><br><br><b>"attribute-resolver.xml"<br><br><br></b> <resolver:AttributeDefinition xsi:type="ad:Simple" id="mail" sourceAttributeID="mail"><br>
<resolver:Dependency ref="myLDAP" /><br> <resolver:AttributeEncoder xsi:type="SAML2String"<br> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br> name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="mail" /> <br>
</resolver:AttributeDefinition><br><br><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br> ldapURL="LDAP_URL" <br> baseDN="ou=public,dc=abc,dc=com" <br>
principal="USER_NAME"<br> principalCredential="PASSWORD"><br> <dc:FilterTemplate><br> <![CDATA[<br> (uid=$requestContext.principalName)<br> ]]><br>
</dc:FilterTemplate><br> </resolver:DataConnector><b><br><br><br><br></b>Even when i comment the statements in "login.config" file, i am not getting any errors in the log file and still getting "No Aattribute Statement" message. Following is the command i am using from "IDP_HOME"<b><br>
<br>aacli.bat --configDir=../conf --principal=<USER_NAME><br><br></b>Could anyone please help me get this working? Am i missing something in the configruation? <br><br>Thank you in advance.<br><font color="#888888"><br>
-- Pavan<br>
</font><br></div></div>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><font color="#888888"><br><br clear="all"><br>-- <br>
<br><br><br><br><br><br>
</font><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><br><br><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><br>-- <br><br><br><br><br><br>
</div></div><font color="#888888">-Ashok Kumar<br>
CSUEB<br>Email: <a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a><br>Phone: <a href="tel:510-885-2141" value="+15108852141" target="_blank">510-885-2141</a><br><br>
</font><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br></blockquote></div></div></div><div><div></div><div class="h5"><br>
<br clear="all"><br>-- <br><br><br><br><br><br>-Ashok Kumar<br>
CSUEB<br>Email: <a href="mailto:ashok.kumar@csueastbay.edu" target="_blank">ashok.kumar@csueastbay.edu</a><br>Phone: <a href="tel:510-885-2141" value="+15108852141" target="_blank">510-885-2141</a><br><br>
</div></div><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br>