<p>Hi Christopher</p>
<p>Thanks for the answer. As mentioned, I did indeed manage to get the wanted information using an LDAP DataConnector however given that the role seems to be already returned by the login module, fast or not, it's still a waste to have to make yet another connection for information that's already been retrieved.<br>
Trying to get the info out of the principal is exactly what I have been trying to do (among other ways) however so far I have had no luck.</p>
<p>If this is not possible, what is the use of the role parameters in the Ldaploginmodule anyway since it works to login without it (The module simply won't "commit" any roles, whatever that means).</p>
<div class="gmail_quote">On Jun 20, 2013 5:56 PM, "Christopher Bongaarts" <<a href="mailto:cab@umn.edu">cab@umn.edu</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 6/20/2013 10:47 AM, Byte Flinger wrote:<br>
> I am now trying to add some attributes to my SAML response from that<br>
> in the LDAP server. I have already managed to get the information I<br>
> want from the LDAP server in an attribute using an LDAP connector<br>
> however given the fact that such information should already be<br>
> returned by the LdapLoginModule, there should be no reason for me to<br>
> have to connect again the ldap server to retrieve such information.<br>
<br>
In general, you do connect again to LDAP to retrieve additional<br>
information, by configuring an LDAP DataConnector in your<br>
attribute-resolver.xml. Then define an attribute based on memberOf.<br>
<br>
The second LDAP request should be fast (you typically search based on<br>
the principal, which is usually a unique identifier that is equality<br>
indexed).<br>
<br>
If "role" is the only thing you'll ever need to release, then you might<br>
be able to get away with pulling out the role from the principal, but<br>
I'll defer to others who might have done that...<br>
<br>
--<br>
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu">cab@umn.edu</a> %%<br>
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" target="_blank">http://umn.edu/~cab</a> %%<br>
%% University of Minnesota %% <a href="tel:%2B1%20%28612%29%20625-1809" value="+16126251809">+1 (612) 625-1809</a> %%<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>