<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
Now that I can fetch attributes from LDAP when authenticating a
subject with IdP using SAML protocols, I would like to include a
multi-valued attribute that has all the groups that the subject is a
member of. The best coverage of this in the archives that I could
find was in the following thread:<br>
<br>
<a class="moz-txt-link-freetext" href="https://groups.google.com/forum/?fromgroups#!searchin/shibboleth-users/ldap$20group/shibboleth-users/IGFGwdwUVHA/RzLAdBcRW2UJ">https://groups.google.com/forum/?fromgroups#!searchin/shibboleth-users/ldap$20group/shibboleth-users/IGFGwdwUVHA/RzLAdBcRW2UJ</a><br>
<br>
I would be grateful for advice on following questions:<br>
<br>
<ul>
<li>What does the FilterTemplate in the following mean (it is from
the thread referenced above)?<br>
<br>
<resolver:DataConnector id="ldapGroups"
xsi:type="LDAPDirectory"<br>
xmlns="urn:mace:shibboleth:2.
<p><wbr>0:resolver:dc"<br>
ldapURL="<a class="moz-txt-link-freetext" href="ldap://">ldap://</a><a href="http://ldap.example.edu"
target="_blank">ldap.example.<wbr>edu</a>"<br>
baseDN="ou=People,dc=example,<wbr>dc=edu"<br>
maxResultSize="500"<br>
mergeResults="true"><br>
<FilterTemplate><br>
<![CDATA[<br>
<br>
(&(objectclass=<wbr>rfc822mailgroup)(member=uid=$<wbr>requestContext.principalName,<wbr>ou=people,dc=example,dc=edu))<br>
]]><br>
</FilterTemplate><br>
<ReturnAttributes>dn</<wbr>ReturnAttributes><br>
</resolver:DataConnector><br>
<br>
</p>
</li>
<li>
<p>I already have a DataConnector as follows. Do I need a second
one for the ldapGroups or can I have multiple FilterTemplates
in same DataConnector.<br>
Here is my existing DataConnector and AttributeDefinition that
references it:<br>
<br>
<resolver:DataConnector id="myLDAP"
xsi:type="dc:LDAPDirectory"<br>
ldapURL=<a class="moz-txt-link-rfc2396E" href="ldap://wellfleet1.wellfleetsoftware.com:10389/">"ldap://wellfleet1.wellfleetsoftware.com:10389/"</a> <br>
baseDN="dc=springframework,dc=org"<br>
principal="uid=admin,ou=system"<br>
principalCredential="ldap1" <br>
><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
(uid=$requestContext.principalName)<br>
]]><br>
</dc:FilterTemplate><br>
<br>
</resolver:DataConnector><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple"
id="uid"<br>
sourceAttributeID="uid"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder
xsi:type="enc:SAML1String"<br>
name="urn:mace:dir:attribute-def:uid" /><br>
<resolver:AttributeEncoder
xsi:type="enc:SAML2String"<br>
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid"
/><br>
</resolver:AttributeDefinition><br>
<br>
</p>
</li>
<li>
<p>Do I need a new AttributeDefinition for the groups attribute?
If so, what does that look like?<br>
<br>
</p>
</li>
</ul>
<p>Thank you for all the terrific help from Scott and other
community members.<br>
</p>
<p>Lastly, for some mysterious reason I did not get responses for
one of my previous questions after several folks responded. I
apologize for asking that question again after it had been
answered.<br>
</p>
<pre class="moz-signature" cols="72">--
Regards,
Farrukh Najmi
Web: <a class="moz-txt-link-freetext" href="http://www.wellfleetsoftware.com">http://www.wellfleetsoftware.com</a>
</pre>
</body>
</html>