<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi David,<br>
<br>
Thanks for your patient help with this thread. I am still
struggling with this due to my lack of familiarity with LDAP.<br>
<br>
Here is how I define LDAP entries in my users.ldif file now. It
defines two persons (Joe and Jane), defines a groupOfNames for
role Developer and finally assigns Joe and Jane as members of the
group Developer.<br>
<br>
#groups definition<br>
dn: ou=groups,dc=springframework,dc=org<br>
objectclass: top<br>
objectclass: organizationalUnit<br>
ou: groups<br>
<br>
#people definition<br>
dn: ou=people,dc=springframework,dc=org<br>
objectclass: top<br>
objectclass: organizationalUnit<br>
ou: people<br>
<br>
#person Joe Developer1 definition<br>
dn: uid=Developer1,ou=people,dc=springframework,dc=org<br>
objectclass: top<br>
objectclass: person<br>
objectclass: organizationalPerson<br>
objectclass: inetOrgPerson<br>
cn: Joe Developer1<br>
sn: Developer1<br>
uid: Developer1<br>
userPassword: 123456<br>
<br>
#person Jane Developer2 definition<br>
dn: uid=Developer2,ou=people,dc=springframework,dc=org<br>
objectclass: top<br>
objectclass: person<br>
objectclass: organizationalPerson<br>
objectclass: inetOrgPerson<br>
cn: Jane Developer2<br>
sn: Developer2<br>
uid: Developer2<br>
userPassword: abcdefg<br>
<br>
#Role Developer definition<br>
dn: cn=urn:test:Role:Developer,ou=groups,dc=springframework,dc=org<br>
objectclass: top<br>
objectclass: groupOfNames<br>
cn: urn:test:Role:Developer<br>
member: uid=<b>Developer1</b>,ou=people,dc=springframework,dc=org<br>
member: uid=Developer2,ou=people,dc=springframework,dc=org<br>
<br>
#Role Manager definition<br>
dn: cn=urn:test:Role:Manager,ou=groups,dc=springframework,dc=org<br>
objectclass: top<br>
objectclass: groupOfNames<br>
cn: urn:test:Role:Manager<br>
member: uid=<b>Developer1</b>,ou=people,dc=springframework,dc=org<br>
<br>
<br>
When I login with IdP using Developer1 credentials, I would like
the resulting <saml2:Assertion> to contain the cn
(preferred) or dn of the groupOfNames that Developer1 is a member
of.<br>
<br>
<saml2:AttributeStatement><br>
<saml2:Attribute FriendlyName="uid"
Name="urn:oid:0.9.2342.19200300.100.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsi=<a
class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xs:string">Developer1</saml2:AttributeValue><br>
</saml2:Attribute><br>
<saml2:Attribute FriendlyName="isMemberOf"
Name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><br>
<saml2:AttributeValue xmlns:xsi=<a
class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xs:string"><b>urn:test:Role:Developer</b></saml2:AttributeValue><br>
<saml2:AttributeValue xmlns:xsi=<a
class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/XMLSchema-instance">"http://www.w3.org/2001/XMLSchema-instance"</a>
xsi:type="xs:string"><b>urn:test:Role:Manager</b></saml2:AttributeValue><br>
</saml2:Attribute><br>
</saml2:AttributeStatement><br>
<br>
<br>
I am quite unclear on how Shib2 IdP configurations in
attribute-resolver.xml works in order to extract attributes <span
style="font-family: Helvetica; font-size: medium; font-style:
normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: 2;
text-align: -webkit-auto; text-indent: 0px; text-transform:
none; white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); display: inline
!important; float: none; ">as shown above</span>.<br>
What is making this hard is that there seems to be a join (using
relational term) between groupOfNames and person <br>
<br>
I would be grateful if you can suggest how I modify my <span
style="font-family: Helvetica; font-size: medium; font-style:
normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: 2;
text-align: -webkit-auto; text-indent: 0px; text-transform:
none; white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); display: inline
!important; float: none; "><resolver:DataConnector</span>>
and <span style="font-family: Helvetica; font-size: medium;
font-style: normal; font-variant: normal; font-weight: normal;
letter-spacing: normal; line-height: normal; orphans: 2;
text-align: -webkit-auto; text-indent: 0px; text-transform:
none; white-space: normal; widows: 2; word-spacing: 0px;
-webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;
background-color: rgb(255, 255, 255); display: inline
!important; float: none; "><resolver:AttributeDefinition>
(see below) to extract the attributes as shown above? </span><br>
<br>
Thanks again for all your kind help.<br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="uid"<br>
sourceAttributeID="uid"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>
name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition xsi:type="ad:Simple"
id="email"<br>
sourceAttributeID="mail"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder<br>
xsi:type="enc:SAML2String"
name="urn:oid:0.9.2342.19200300.100.1.3"<br>
friendlyName="mail" /><br>
</resolver:AttributeDefinition><br>
<br>
<resolver:AttributeDefinition id="isMemberOf"
xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"<br>
sourceAttributeID="member"><br>
<resolver:Dependency ref="ldapGroups" /><br>
<resolver:AttributeEncoder xsi:type="SAML2String"
xmlns="urn:mace:shibboleth:2.0:attribute:encoder"<br>
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="isMemberOf"
/><br>
</resolver:AttributeDefinition> <br>
<br>
<resolver:DataConnector id="myLDAP"
xsi:type="dc:LDAPDirectory"<br>
ldapURL=<a class="moz-txt-link-rfc2396E" href="ldap://wellfleet1.wellfleetsoftware.com:10389/">"ldap://wellfleet1.wellfleetsoftware.com:10389/"</a> <br>
baseDN="dc=springframework,dc=org"<br>
principal="uid=admin,ou=system"<br>
principalCredential="ldap1"<br>
><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
(uid=$requestContext.principalName)<br>
]]><br>
</dc:FilterTemplate><br>
<br>
</resolver:DataConnector><br>
<br>
<resolver:DataConnector id="ldapGroups"
xsi:type="dc:LDAPDirectory"<br>
ldapURL=<a class="moz-txt-link-rfc2396E" href="ldap://wellfleet1.wellfleetsoftware.com:10389/">"ldap://wellfleet1.wellfleetsoftware.com:10389/"</a> <br>
baseDN="dc=springframework,dc=org"<br>
principal="uid=admin,ou=system"<br>
principalCredential="ldap1"<br>
maxResultSize="500"<br>
mergeResults="true"><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
<br>
(&(objectclass=groupOfNames)(member=uid=$requestContext.principalName,ou=people,dc=springframework,dc=org))<br>
]]><br>
</dc:FilterTemplate> <br>
</resolver:DataConnector> <br>
<br>
</div>
<pre class="moz-signature" cols="72">--
Regards,
Farrukh Najmi
Web: <a class="moz-txt-link-freetext" href="http://www.wellfleetsoftware.com">http://www.wellfleetsoftware.com</a>
</pre>
</body>
</html>