<br>Here is the problem. We are migrating users away from one mail system to another mail system. We want users who have NOT been officially migrated to the new mail system to be unable to access the new mail system. We want this behavior because we will be provisioning the users in the new system before we roll out the new system to the users.<br>
<br>OK. So, what we have done is to create a principal name for the new system: <br><br> <!-- BEGIN GOOGLE NAME ID --> <br> <resolver:AttributeDefinition id="GooglePrincipal" xsi:type="PrincipalName" xmlns="urn:mace:shibboleth:2.0:resolver:ad"<br>
sourceAttributeID="uid" ><br> <resolver:Dependency ref="GoogleLDAP" /><br><br> <resolver:AttributeEncoder xsi:type="SAML2StringNameID"<br> xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
nameFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" /><br><br><br> </resolver:AttributeDefinition ><br> <!-- END GOOGLE NAME ID --> <br><br>And for the ldap query to get the principal name we have created an ldap connector called GoogleLDAP. Here it is:<br>
<br><resolver:DataConnector xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"<br> id="GoogleLDAP"<br> ldapURL="ldaps://<a href="http://directory.georgetown.edu">directory.georgetown.edu</a>"<br>
baseDN="dc=georgetown,dc=edu"<br> principal="cn=uidWebMapping1,ou=Specials,dc=georgetown,dc=edu"<br> principalCredential="uidWebMapping"<br>
noResultIsError="true"><br><br><br><br> <FilterTemplate><br> <![CDATA[<br> (&(uid=${requestContext.principalName})(|(guService=GUMail.GAE.Migration.Complete.*)(guService=GUMail.GAE.Migration.<br>
Candidate)))<br> ]]><br> </FilterTemplate><br><br>Note that the query will return a value only when the guService attributes are correctly populated.<br><br>We have tested and people without the correct guService attributes are denied access. This is good.<br>
<br>However, when a person without the guService attributes tries to log into some other SP we get the error (from idp-process.log):<br><br>WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:465] - Error resolving at<br>
tributes for principal 'dhm24'. No name identifier or attribute statement will be included in response<br><br>The browser appears to be in a loop of some sort. I have not been able to see the url's because they are going by too fast.<br>
<br>Does anyone have any ideas as to what my problem is?<br><br>Thanks,<br><br>Dave<br>