<div dir="ltr">Hi<div><br></div><div style>I have setup a Shibboleth IDP with LDAP authentication using the LdapLoginModule authentication module. Things are working fine.</div><div style><br></div><div style>I am now trying to add some attributes to my SAML response from that in the LDAP server. I have already managed to get the information I want from the LDAP server in an attribute using an LDAP connector however given the fact that such information should already be returned by the LdapLoginModule, there should be no reason for me to have to connect again the ldap server to retrieve such information.</div>
<div style><br></div><div style>In the debug logs I can see the following lines after I login the ldap server</div><div style><br></div><div style><div>16:56:09.137 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:223] - Committed the following principals: [username[memberOf[cn=idp,ou=groups,l=er,dc=somedc,dc=com]]]</div>
<div>16:56:09.137 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:229] - Committed the following roles: [cn=idp,ou=groups,l=er,dc=somedc,dc=com]</div><div><br></div><div><br></div><div style>This looks to me that the ldap module adding both the role and username somewhere within Shibboleth (requestContext maybe?).</div>
<div style><br></div><div style>I have been able to retrieve the username using a PrincipalName attributeDefinition however I cannot find how to retrieve the role from the context. The PrincipalName only returns "username" (using the example logs given above), so I am not sure where the information inside the brackets or even the "roles", that module claims to be commiting, can be accessed.</div>
<div style><br></div><div style>I can see the requestContext has a private field called "PrincipalAttributes" however there is no get method for that field and the "getAttributes" method returns NULL, so my script ideas so far have gone nowhere.</div>
<div style><br></div><div style>Can anybody shed some light into the situation?</div></div></div>