<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:154343939;
mso-list-type:hybrid;
mso-list-template-ids:673225310 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Happy April Fools, everyone!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I have created my own Attribute Resolver Script based off Vladimir Mencl’s example: (<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples">https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverScriptAttributeDefinitionExamples</a>
) My script preforms a recursive group membership lookup in AD, and then stores that multi-value so my attribute filter can use it to determine if it should pass on attributes to a specific SP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">And it works--most of the time. : ) Occasionally the log shows that accounts will fail to pass on the needed attributes to the SP, but if the same account tries 5 minutes later—it passes on those attributes successfully.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think it must be an issue with either the time limit we place on the LDAP query, or how the value is stored—but I’m having trouble finding data that supports either theory. Could you help me with some questions?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Is there any way I can output *<b>all</b>* the values stored in my attribute by the recursive LDAP search? (Called ‘memberof’ and ‘DistinguishedNamed’ in the data connector below.) It would help me troubleshoot the issue. I have tried
‘passing it on’ to a test SP in attempt to check the value there, but I believe that is not working because of the multiple values stored in the attribute.<o:p></o:p></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Will Trace or Debug logging levels capture what the Attribute Resolver Script is doing? Perhaps I could turn them on and wait for the problem to happen again?<o:p></o:p></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><![if !supportLists]><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>I do not know very much about Service Providers yet. Can SPs place a time restriction how on how long it’s authentication request is valid for? If we end up having to increase the TimeLimit for the query I should make sure I know about
any hard upper limit.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For reference if so desired, here is a copy of my attribute resolver script, and my attribute filter that uses it.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>ATTRIBUTE RESOLVER:<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <resolver:DataConnector id="groupLDAP" xsi:type="dc:LDAPDirectory"<o:p></o:p></p>
<p class="MsoNormal"> useStartTLS="true"<o:p></o:p></p>
<p class="MsoNormal"> ldapURL="ldap://seadog.JACKS.LOCAL:389"<o:p></o:p></p>
<p class="MsoNormal"> baseDN="DC=jacks,DC=local" <o:p>
</o:p></p>
<p class="MsoNormal"> principal="MYUSERNAME"<o:p></o:p></p>
<p class="MsoNormal"> principalCredential="MYPASSWORD"<o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"> maxResultSize="1000"<o:p></o:p></p>
<p class="MsoNormal"> mergeResults="true"<o:p></o:p></p>
<p class="MsoNormal"> searchTimeLimit="PT15.000S"><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <resolver:Dependency ref="distinguishedName" /><o:p></o:p></p>
<p class="MsoNormal"> <dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <![CDATA[<o:p></o:p></p>
<p class="MsoNormal"> (member:1.2.840.113556.1.4.1941:=${distinguishedName.get(0)})<o:p></o:p></p>
<p class="MsoNormal"> ]]><o:p></o:p></p>
<p class="MsoNormal"> </dc:FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <dc:ReturnAttributes>distinguishedName</dc:ReturnAttributes><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <dc:LDAPProperty name="java.naming.referral" value="follow"/><o:p></o:p></p>
<p class="MsoNormal"> </resolver:DataConnector><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <resolver:AttributeDefinition id="memberOf" xsi:type="ad:Simple"<o:p></o:p></p>
<p class="MsoNormal"> sourceAttributeID="distinguishedName"><o:p></o:p></p>
<p class="MsoNormal"> <resolver:Dependency ref="groupLDAP" /><o:p></o:p></p>
<p class="MsoNormal"> <!-- no encoder needed --><o:p></o:p></p>
<p class="MsoNormal"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>ATTRIBUTE FILTER:<o:p></o:p></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><afp:AttributeFilterPolicy id="releaseToBoxDotCom"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <afp:PolicyRequirementRule xsi:type="basic:AND"><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <basic:Rule xsi:type="basic:AttributeValueString" attributeID="memberOf" value="CN=SDSU All Shibboleth Users,OU=WWW and Intranet,DC=jacks,DC=local" ignoreCase="true"/>
<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <basic:Rule xsi:type="basic:AttributeRequesterString" value="box.net" ignoreCase="true"/><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> </afp:PolicyRequirementRule><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <afp:AttributeRule attributeID="First Name"><o:p></o:p></p>
<p class="MsoNormal"> <!-- Permit value rule that releases any value. --><o:p></o:p></p>
<p class="MsoNormal"> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p>
<p class="MsoNormal"> </afp:AttributeRule><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <afp:AttributeRule attributeID="Last Name"><o:p></o:p></p>
<p class="MsoNormal"> <!-- Permit value rule that releases any value. --><o:p></o:p></p>
<p class="MsoNormal"> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p>
<p class="MsoNormal"> </afp:AttributeRule><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <afp:AttributeRule attributeID="email"><o:p></o:p></p>
<p class="MsoNormal"> <!-- Permit value rule that releases any value. --><o:p></o:p></p>
<p class="MsoNormal"> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p>
<p class="MsoNormal"> </afp:AttributeRule><o:p></o:p></p>
<p class="MsoNormal">
<o:p></o:p></p>
<p class="MsoNormal"> </afp:AttributeFilterPolicy><o:p></o:p></p>
</div>
</body>
</html>