<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Our IdP uses both a generic LDAP directory and MS Domain AD for authentication and attributes. We've not previously had relying services consume group membership; I'm setting that up now, and have a couple of questions on which I seek input:<div><br></div><div>(1) Our first request for group membership requests the group membership from these two sources be passed in different SAML attributes (there is little overlap in the group membership data in the two sources). This seems reasonable enough to me, but am I missing some problem that this would entail? I guess this has two parts: </div><div>Is it appropriate to resolve and release the bare directory attributes </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>(as opposed to tidying them up in some way as suggested in <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples">https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples</a>)? and</div><div>Is it appropriate to keep these in separate attributes for release (rather than combining them)?</div><div><br></div><div>(2) Assuming we do resolve two different attributes for SAML, </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>one based on AD's memberOf attribute </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>(values like CN=MTS-Radius,OU=RAS Client Groups,OU=Radius,OU=SW,DC=ua,DC=ad,DC=alaska,DC=edu), </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>the other based on an LDAP attribute (mis-)named eduIsMemberOf </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>(values like cn=appusers:onbaseprod:admin_document,ou=group,dc=alaska,dc=edu)</div><div>Do I simply have two resolver definitions like:</div><div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><resolver:AttributeDefinition id="isMemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="eduIsMemberOf"></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><span class="Apple-tab-span" style="white-space:pre"> </span><resolver:Dependency ref="myLDAP" /></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><span class="Apple-tab-span" style="white-space:pre"> </span><resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:mace:dir:attribute-def:isMemberOf" /></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><span class="Apple-tab-span" style="white-space:pre"> </span><resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf" /></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "></resolver:AttributeDefinition></div><div style="margin: 0px; font-size: 11px; font-family: Courier; min-height: 13px; "><br></div><div style="margin: 0px; font-size: 11px; font-family: Courier; min-height: 13px; "><br></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><resolver:AttributeDefinition id="ADMemberOf" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="memberOf"></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><span class="Apple-tab-span" style="white-space:pre"> </span><resolver:Dependency ref="uaADLDAP" /></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><span class="Apple-tab-span" style="white-space:pre"> </span><resolver:AttributeEncoder xsi:type="SAML1String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:mace:dir:attribute-def:ADmemberOf" /></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "><span class="Apple-tab-span" style="white-space:pre"> </span><resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="ADmemberOf" /></div><div style="margin: 0px; font-size: 11px; font-family: Courier; "></resolver:AttributeDefinition></div></div><div><br></div><div>Thanks for your advice,</div><div><br></div><div>David Bantz</div><div>U Alaska IAM</div></body></html>