<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi David,<br>
<br>
Thanks very much for your help. I managed to get isMemberOf
attribute pulled from LDAP using your guidance.<br>
<br>
For other newbies like me I will summarize inline below...<br>
<br>
<br>
<br>
On 06/12/2013 04:47 PM, David Bantz wrote:<br>
</div>
<blockquote
cite="mid:A5E8164C-8B4B-4AE5-9FEC-B32BAE159E68@Alaska.edu"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<br>
<div>
<div>On Wed, 12 Jun 2013, at 08:43 , Farrukh Najmi <<a
moz-do-not-send="true"
href="mailto:farrukh@wellfleetsoftware.com">farrukh@wellfleetsoftware.com</a>>
wrote:</div>
<blockquote type="cite">
<div bgcolor="#FFFFFF" text="#000000">
<ul>
<li>What does the FilterTemplate in the following mean (it
is from the thread referenced above)?<br>
<br>
<resolver:DataConnector id="ldapGroups"
xsi:type="LDAPDirectory"<br>
<p>...<br>
<FilterTemplate><br>
<![CDATA[<br>
(&(objectclass=<wbr>rfc822mailgroup)(member=uid=$<wbr>requestContext.principalName,<wbr>ou=people,dc=example,dc=edu))<br>
]]><br>
</FilterTemplate><br>
</p>
</li>
</ul>
</div>
</blockquote>
<div><br>
</div>
<div>describes how to look up the principal in your LDAP
Directory given what the end-user has entered; </div>
<div>in this case limiting to particular object class in the
LDAP Directory and looking to match the end-user input</div>
<div>to member or uid of a record in ou=people… tree.</div>
</div>
</blockquote>
<br>
Yes. And a helpful resource I found on LDAP Filter syntax is this:<br>
<br>
<a class="moz-txt-link-freetext" href="http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm">http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm</a><br>
<br>
The syntax is a bit unusual for any one not exposed to it.<br>
<br>
Above filter is a logical AND (see & operator) of two
conditions.<br>
<ul>
<li>objectclass is equal to rfc822mailgroup</li>
<li>member attribute is equal to uid=$requestContext.principalName,ou=people,dc=example,dc=edu</li>
</ul>
<br>
<blockquote
cite="mid:A5E8164C-8B4B-4AE5-9FEC-B32BAE159E68@Alaska.edu"
type="cite">
<div>
<div><br>
</div>
<blockquote type="cite"><span style="background-color: rgb(255,
255, 255); "> Do I need a second one for the ldapGroups</span><br>
</blockquote>
<div><br>
</div>
No, just one connector for one directory source.</div>
</blockquote>
<br>
I did not get this part of your suggestion. I need two filters:<br>
<ul>
<li>One to match the uid for the entry representing the person,
and<br>
</li>
<li>Another to match the rfc822mailgroup entry (BTW, in my LDAP
data this was groupOfNames not rfc822mailgroup)</li>
</ul>
So I defined two separate DataConnectors as follows, one for each
Filter in attribute-resolver.xml:<br>
<br>
<resolver:DataConnector id="myLDAP"
xsi:type="dc:LDAPDirectory"<br>
ldapURL=<a class="moz-txt-link-rfc2396E" href="ldap://wellfleet1.wellfleetsoftware.com:10389/">"ldap://wellfleet1.wellfleetsoftware.com:10389/"</a> <br>
baseDN="dc=springframework,dc=org"<br>
principal="uid=admin,ou=system"<br>
principalCredential="ldap1"<br>
><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
(uid=$requestContext.principalName)<br>
]]><br>
</dc:FilterTemplate><br>
<br>
</resolver:DataConnector><br>
<br>
<resolver:DataConnector id="ldapGroups"
xsi:type="dc:LDAPDirectory"<br>
ldapURL=<a class="moz-txt-link-rfc2396E" href="ldap://wellfleet1.wellfleetsoftware.com:10389/">"ldap://wellfleet1.wellfleetsoftware.com:10389/"</a> <br>
baseDN="dc=springframework,dc=org"<br>
principal="uid=admin,ou=system"<br>
principalCredential="ldap1"<br>
maxResultSize="500"<br>
mergeResults="true"><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
<br>
(&(objectclass=groupOfNames)(member=uid=$requestContext.principalName,ou=people,dc=springframework,dc=org))<br>
]]><br>
</dc:FilterTemplate> <br>
</resolver:DataConnector> <br>
<br>
The first DataConnector myLDAP was referenced from
AttributeDefinitions for the attributes for the person entry:<br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"<br>
sourceAttributeID="uid"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"<br>
name="urn:mace:dir:attribute-def:uid" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="email"<br>
sourceAttributeID="mail"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"<br>
name="urn:mace:dir:attribute-def:mail" /> <br>
<resolver:AttributeEncoder<br>
xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3"<br>
friendlyName="mail" /><br>
</resolver:AttributeDefinition><br>
<br>
The second DataConnector ldapGroups was referenced from the
AttributeDefinitions for the attributes for the person entry modeled
after your suggestion:<br>
<br>
<resolver:AttributeDefinition id="isMemberOf"
xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"<br>
sourceAttributeID="member"><br>
<resolver:Dependency ref="ldapGroups" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"<br>
name="urn:mace:dir:attribute-def:isMemberOf" /> <br>
<resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf"
/><br>
</resolver:AttributeDefinition><br>
<br>
<br>
<blockquote
cite="mid:A5E8164C-8B4B-4AE5-9FEC-B32BAE159E68@Alaska.edu"
type="cite">
<div><br>
<blockquote type="cite">
<blockquote type="cite">
<div bgcolor="#FFFFFF" text="#000000">
<ul>
</ul>
</div>
</blockquote>
</blockquote>
<blockquote type="cite">
<div bgcolor="#FFFFFF" text="#000000">
<ul>
<li>
<p>Do I need a new AttributeDefinition for the groups
attribute? If so, what does that look like?<br>
</p>
</li>
</ul>
</div>
</blockquote>
<div><br>
</div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(255, 147, 0); "><span style="color: #323333">
</span><span style="color: #091480"><resolver:AttributeDefinition
</span><span style="color: #098021">id=</span>"isMemberOf"<span
style="color: #091480"> </span><span style="color: #098021">xsi:type=</span>"Simple"<span
style="color: #091480"> </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:resolver:ad"</div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(9, 128, 33); "><span style="color: #091480">
</span>sourceAttributeID=<span style="color: #ff9300">"eduIsMemberOf"</span><span
style="color: #091480">></span></div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(9, 20, 128); "><span style="color: #323333">
</span><resolver:Dependency <span style="color:
#098021">ref=</span><span style="color: #ff9300">"myLDAP"</span>
/></div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(255, 147, 0); "><span style="color: #323333">
</span><span style="color: #091480"><resolver:AttributeEncoder
</span><span style="color: #098021">xsi:type=</span>"SAML2String"<span
style="color: #091480"> </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:attribute:encoder"</div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(255, 147, 0); "><span style="color: #091480">
</span><span style="color: #098021">name=</span>"urn:oid:1.3.6.1.4.1.5923.1.5.1.1"<span
style="color: #091480"> </span><span style="color: #098021">friendlyName=</span>"isMemberOf"<span
style="color: #091480"> /></span></div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(9, 20, 128); "><span style="color: #323333">
</span></resolver:AttributeDefinition></div>
<div><br>
</div>
<div>or </div>
<div><br>
</div>
<div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(255, 147, 0); "><span style="color:
#323333"> </span><span style="color: #091480"><resolver:AttributeDefinition
</span><span style="color: #098021">id=</span>"ADmemberOf"<span
style="color: #091480"> </span><span style="color:
#098021">xsi:type=</span>"Simple"<span style="color:
#091480"> </span><span style="color: #4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:resolver:ad"<span
style="color: #091480"> </span><span style="color:
#098021">sourceAttributeID=</span>"memberOf"<span
style="color: #091480">></span></div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(9, 20, 128); "><span style="color:
#323333"><span class="Apple-tab-span"
style="white-space:pre"> </span></span><resolver:Dependency
<span style="color: #098021">ref=</span><span style="color:
#ff9300">"myADLDAP"</span> /></div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(255, 147, 0); "><span style="color:
#323333"><span class="Apple-tab-span"
style="white-space:pre"> </span></span><span
style="color: #091480"><resolver:AttributeEncoder </span><span
style="color: #098021">xsi:type=</span>"SAML2String"<span
style="color: #091480"> </span><span style="color:
#4b5a7d">xmlns=</span>"urn:mace:shibboleth:2.0:attribute:encoder"<span
style="color: #091480"> </span><span style="color:
#098021">name=</span>"urn:oid:1.2.840.113556.1.2.102"<span
style="color: #091480"> </span><span style="color:
#098021">friendlyName=</span>"ADmemberOf"<span
style="color: #091480"> /></span></div>
<div style="margin: 0px; font-size: 13px; font-family: 'Lucida
Sans'; color: rgb(9, 20, 128); "><span style="color:
#323333"> </span></resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<br>
</div>
</blockquote>
<br>
I was not sure what the difference between above two was so I went
with the first one and added an AttributeENcoder for SAML1String
(see listing earlier).<br>
<br>
Lastly, I had to make sure that my attribute-filter.xml file had the
following to permit releasing the isMemberOfAttribute to any one:<br>
<br>
<afp:AttributeRule attributeID="isMemberOf"><br>
<afp:PermitValueRule xsi:type="basic:ANY"/><br>
</afp:AttributeRule><br>
<br>
This all worked like a charm. Thank you for your terrific help!<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Regards,
Farrukh Najmi
Web: <a class="moz-txt-link-freetext" href="http://www.wellfleetsoftware.com">http://www.wellfleetsoftware.com</a>
</pre>
</body>
</html>