<div dir="ltr">Try something like this..<div><br></div><div><div> <resolver:AttributeDefinition id="groupMembership" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"</div><div>
sourceAttributeID="entryDN"></div><div> <resolver:Dependency ref="groupMembership" /></div><div> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.16.840.1.113719.1.1.4.1.25" friendlyName="groupMembership" /><br>
</div><div> </resolver:AttributeDefinition></div></div><div><br></div><div><div> <resolver:DataConnector</div><div> id=groupMembership"</div><div> xsi:type="LDAPDirectory"</div>
<div> xmlns="urn:mace:shibboleth:2.0:resolver:dc"</div><div> ldapURL="ldap://<a href="http://ldap.example.edu">ldap.example.edu</a>"</div><div> baseDN="ou=User Groups,ou=Groups,dc=example,dc=edu"</div>
<div> maxResultSize="350"</div><div> mergeResults="true"></div><div> <FilterTemplate></div><div> <![CDATA[</div><div> (&(objectclass=group)(member=uid=${requestContext.principalName},ou=people,dc=example,dc=edu))</div>
<div> ]]></div><div> </FilterTemplate></div><div> <ReturnAttributes>entryDN</ReturnAttributes></div><div> </resolver:DataConnector></div></div><div><br></div><div>You might want to turn on the result caching. The query brought our eDirectory servers to their knees (we do nested group expansion).</div>
<div><br></div><div>Liam</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jul 18, 2014 at 10:39 AM, Richard Genthner <span dir="ltr"><<a href="mailto:moose@symplicity.com" target="_blank">moose@symplicity.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">I'm running on ldap and in
all my scripts to get group membership, I use this filter<br>
<br>
"(&(objectClass=posixGroup)(memberUid=moose))" cn<br>
<br>
I"m trying to figure out how I can make shibboleth do something similar
with out losing my authentication.<br>
<br>
<blockquote style="border:0px none" type="cite">
<div style="margin:30px 25px 10px 25px"><div style="display:table;width:100%;border-top:1px solid #edeef0;padding-top:5px"> <div style="display:table-cell;vertical-align:middle;padding-right:6px"><img src="cid:part1.07060609.07090108@symplicity.com" name="14749ea49a4c74a9_postbox-contact.jpg" height="25px" width="25px"></div>
<div style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a href="mailto:Smith@cardiff.ac.uk" style="color:#737f92!important;padding-right:6px;font-weight:bold;text-decoration:none!important" target="_blank">Rhys Smith</a></div> <div style="display:table-cell;white-space:nowrap;vertical-align:middle">
<font color="#9FA2A5"><span style="padding-left:6px">July 18, 2014 at
10:23 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px"><div class=""><div>Yep, my answer is
completely subject (may or may not work for you) depending on your
answer to Peter’s point also...<br>--<br>Dr Rhys Smith<br>Identity,
Access, and Middleware Specialist<br>Cardiff University & Janet, the
UK's research and education network<br><br>email: <a href="mailto:smith@cardiff.ac.uk" target="_blank">smith@cardiff.ac.uk</a> /
<a href="mailto:rhys.smith@ja.net" target="_blank">rhys.smith@ja.net</a><br>GPG: 0x4638C985<br><br></div><div><br></div></div><div class=""><div>--<br>To
unsubscribe from this list send an email to
<a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></div></div></div>
<div style="margin:30px 25px 10px 25px"><div style="display:table;width:100%;border-top:1px solid #edeef0;padding-top:5px"> <div style="display:table-cell;vertical-align:middle;padding-right:6px"><img src="cid:part1.07060609.07090108@symplicity.com" name="14749ea49a4c74a9_postbox-contact.jpg" height="25px" width="25px"></div>
<div style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a href="mailto:Smith@cardiff.ac.uk" style="color:#737f92!important;padding-right:6px;font-weight:bold;text-decoration:none!important" target="_blank">Rhys Smith</a></div> <div style="display:table-cell;white-space:nowrap;vertical-align:middle">
<font color="#9FA2A5"><span style="padding-left:6px">July 18, 2014 at
10:20 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px"><div><div class="h5"><div>If you’re using a
directory that stores this in the memberOf attribute (e.g. AD), then
just add something like the following to attribute-resolver.xml
(assuming the principal you use to connect to your LDAP have read rights
to the attribute):<br><br> <resolver:AttributeDefinition
xsi:type="ad:Simple" id="memberOf" sourceAttributeID=“memberOf"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:memberOf" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" /><br>
</resolver:AttributeDefinition><br><br>Note that if using
something like eDirectory, this is stored in the groupMembership
attribute rather than the memberOf attribute.<br><br>Also, I’ve had some
thing on the other end using SAML1 that expected it to be called
“isMemberOf” rather than “memberOf”, so my full attribute config (we use
eDir) looks like this<br><br> <!-- Group Membership. Exists as
groupMembership in eDir, but usually known as memberOf so we use that
name, also isMemberOf over SAML1 --><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf"
sourceAttributeID="groupMembership"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:memberOf" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:isMemberOf" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" /><br>
</resolver:AttributeDefinition><br><br>Finally, note that
memberOf or isMemberOf was never registered in the
urn:mace:dir:attribute-def: namespace so what I’ve done is completely
wrong (improper rather than won’t work), but I had some stuff on the
other end that was expecting it to have that name so I just bit the
bullet and did it against my own objections.<br><br>If you’re just doing
this internally, and you control what the SP(s) so can map from
whatever name you care to define, then the safer and more proper thing
would be to just use the OID name even in SAML1, e.g.<br><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf"
sourceAttributeID="groupMembership"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" /><br>
</resolver:AttributeDefinition><br><br>Of course, if this is
going to be SAML2 only, then you can just ignore that problem and just
have the one SAML2 encoder.<br><br><br>HTH,<br>Rhys.<br>--<br>Dr Rhys
Smith<br>Identity, Access, and Middleware Specialist<br>Cardiff
University & Janet, the UK's research and education network<br><br>email:
<a href="mailto:smith@cardiff.ac.uk" target="_blank">smith@cardiff.ac.uk</a> / <a href="mailto:rhys.smith@ja.net" target="_blank">rhys.smith@ja.net</a><br>GPG: 0x4638C985<br><br></div><div><br></div></div></div><div class="">
<div>--<br>To
unsubscribe from this list send an email to
<a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></div></div></div>
<div style="margin:30px 25px 10px 25px"><div style="display:table;width:100%;border-top:1px solid #edeef0;padding-top:5px"> <div style="display:table-cell;vertical-align:middle;padding-right:6px"><img src="cid:part3.09010508.04030603@symplicity.com" name="14749ea49a4c74a9_postbox-contact.jpg" height="25px" width="25px"></div>
<div style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a href="mailto:moose@symplicity.com" style="color:#737f92!important;padding-right:6px;font-weight:bold;text-decoration:none!important" target="_blank">Richard Genthner</a></div> <div style="display:table-cell;white-space:nowrap;vertical-align:middle">
<font color="#9FA2A5"><span style="padding-left:6px">July 18, 2014 at
9:55 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px"><div class="">
I have been trying to figure out how to expose ldap groups that a user
belongs too. Does anyone have ideas on how to expose these ?<br>
<br>
</div><div>--<div class=""><br>To unsubscribe from this list send an email to
<a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></div></div></div>
</blockquote>
<br>
<div>-- <br><div class=""><span><pre>--
Richard Genthner
Senior System Administrator
<a href="mailto:rgenthner@symplicity.com" target="_blank">rgenthner@symplicity.com</a>
<span style="display:inline;font-size:inherit;padding:0pt;color:rgb(102,102,102)">tel. <a href="tel:703-351-0200%20x8051" value="+17033510200" target="_blank">703-351-0200 x8051</a>
</span>Direct <a href="tel:703-373-7033" value="+17033737033" target="_blank">703-373-7033</a>
<a>sip:8051@voip.symplicity.com</a>
Symplicity Corporation
<a href="http://www.symplicity.com" target="_blank">http://www.symplicity.com</a>
</pre> </span></div></div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>