<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
A question was asked of me over lunch from a supervisor, and I had a play in our Dev environment and got it "working" - though I thought there might be a cleaner way.
<div><br>
</div>
<div>We can't Shibbolise everything, and as such there are a few differing concepts of a "username" in different systems, for example:</div>
<div>
<ul class="MailOutline">
<li>username</li><li><a href="mailto:username@example.com">username@example.com</a></li><li><a href="mailto:email.address@example.com">email.address@example.com</a></li></ul>
</div>
<div><br>
</div>
<div>So the lunchtime question was could we get Shibboleth to work with all of these "username" types. From my first paragraph the answer was yes, but I wasn't entirely happy with it.</div>
<div><br>
</div>
<div>So I have login.config:</div>
<div><br>
</div>
<div>
<div>ShibUserPassAuth {</div>
<div> edu.vt.middleware.ldap.jaas.LdapLoginModule required</div>
<div> ldapUrl="<a href="ldap://ldap.example.com:389">ldap://ldap.example.com:389</a>"</div>
<div> baseDn="ou=users,dc=example,dc=com"</div>
<div> userFilter="(|(uid={0})(scopeduid={0})(mail={0}))"</div>
<div> ;</div>
<div>};</div>
</div>
<div><br>
</div>
<div>In the attribute-filter, as we already were mapping for the <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler">Kerberos Login Handler</a>, the scopeduid was already converted as required, all I needed to do was adjust
the filter in the LDAPDirectory DataConnector to also search the mail address.</div>
<div><br>
</div>
<div>
<div> <resolver:AttributeDefinition id="principalName"</div>
<div> xsi:type="ad:PrincipalName"</div>
<div> dependencyOnly="true"></div>
<div> </resolver:AttributeDefinition></div>
<div><br>
</div>
<div> <resolver:AttributeDefinition id="mappedPrincipalName"</div>
<div> xsi:type="ad:Mapped"</div>
<div> sourceAttributeID="principalName"</div>
<div> dependencyOnly="true" ></div>
<div> <resolver:Dependency ref="principalName" /></div>
<div> <ad:DefaultValue passThru="true" /></div>
<div> <ad:ValueMap></div>
<div> <ad:ReturnValue>$1</ad:ReturnValue></div>
<div> <!-- Match plain username (Web Page Auth) or kerberos username (contains an @) --></div>
<div> <ad:SourceValue>([^@]+)(@.+)?</ad:SourceValue></div>
<div> </ad:ValueMap></div>
<div> </resolver:AttributeDefinition></div>
</div>
<div><br>
</div>
<div>
<div> <resolver:DataConnector xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"</div>
<div> id="LDAP"</div>
<div> ldapURL="${ldap.url}"</div>
<div> principal="${ldap.user}"</div>
<div> principalCredential="${ldap.password}"</div>
<div> baseDN="OU=People,${ldap.rootDN}"></div>
<div> <resolver:Dependency ref="principalName" /></div>
<div> <resolver:Dependency ref="mappedPrincipalName" /></div>
<div> <dc:FilterTemplate></div>
<div> <![CDATA[</div>
<div> (|(uid=${mappedPrincipalName.get(0)})(mail=${requestContext.principalName}))</div>
<div> ]]></div>
<div> </dc:FilterTemplate></div>
<div> <dc:ReturnAttributes>uid</dc:ReturnAttributes></div>
<div> </resolver:DataConnector></div>
</div>
<div><br>
</div>
<div><br>
</div>
<div>While this all functions, I spent quite some time searching for a way to do it all in the login.config - I thought I would be able to specify what is populated as the PrincipalName. Maybe someone has tackled this before, or maybe it's not possible.</div>
<div><br>
</div>
<div>Also I don't think there is anything significantly bad with doing this, but was wondering if anyone had an alternate view before I get an official request to actually do it.</div>
<div><br>
</div>
<div>Cheers</div>
<div>Aaron</div>
<span style="font-size: 9.0pt; font-family: 'Calibri'; "><em><strong><br>Important Notice:</strong> The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.<br><br>Deakin University does not warrant that this email and any attachments are error or virus free.</em></span></body>
</html>