<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000">I'm running on ldap and in
all my scripts to get group membership, I use this filter<br>
<br>
"(&(objectClass=posixGroup)(memberUid=moose))" cn<br>
<br>
I"m trying to figure out how I can make shibboleth do something similar
with out losing my authentication.<br>
<br>
<blockquote style="border: 0px none;"
cite="mid:D0F0FFB9-386C-41CE-A8D3-6B6D6F57F6BE@cardiff.ac.uk"
type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="Smith@cardiff.ac.uk" photoname="Rhys Smith"
src="cid:part1.07060609.07090108@symplicity.com"
name="postbox-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:Smith@cardiff.ac.uk"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Rhys Smith</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">July 18, 2014 at
10:23 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div>Yep, my answer is
completely subject (may or may not work for you) depending on your
answer to Peter’s point also...<br>--<br>Dr Rhys Smith<br>Identity,
Access, and Middleware Specialist<br>Cardiff University & Janet, the
UK's research and education network<br><br>email: <a class="moz-txt-link-abbreviated" href="mailto:smith@cardiff.ac.uk">smith@cardiff.ac.uk</a> /
<a class="moz-txt-link-abbreviated" href="mailto:rhys.smith@ja.net">rhys.smith@ja.net</a><br>GPG: 0x4638C985<br><br></div><div><!----><br></div><div>--<br>To
unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div>
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="Smith@cardiff.ac.uk" photoname="Rhys Smith"
src="cid:part1.07060609.07090108@symplicity.com"
name="postbox-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:Smith@cardiff.ac.uk"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Rhys Smith</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">July 18, 2014 at
10:20 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div>If you’re using a
directory that stores this in the memberOf attribute (e.g. AD), then
just add something like the following to attribute-resolver.xml
(assuming the principal you use to connect to your LDAP have read rights
to the attribute):<br><br> <resolver:AttributeDefinition
xsi:type="ad:Simple" id="memberOf" sourceAttributeID=“memberOf"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:memberOf" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" /><br>
</resolver:AttributeDefinition><br><br>Note that if using
something like eDirectory, this is stored in the groupMembership
attribute rather than the memberOf attribute.<br><br>Also, I’ve had some
thing on the other end using SAML1 that expected it to be called
“isMemberOf” rather than “memberOf”, so my full attribute config (we use
eDir) looks like this<br><br> <!-- Group Membership. Exists as
groupMembership in eDir, but usually known as memberOf so we use that
name, also isMemberOf over SAML1 --><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf"
sourceAttributeID="groupMembership"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:memberOf" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:mace:dir:attribute-def:isMemberOf" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" /><br>
</resolver:AttributeDefinition><br><br>Finally, note that
memberOf or isMemberOf was never registered in the
urn:mace:dir:attribute-def: namespace so what I’ve done is completely
wrong (improper rather than won’t work), but I had some stuff on the
other end that was expecting it to have that name so I just bit the
bullet and did it against my own objections.<br><br>If you’re just doing
this internally, and you control what the SP(s) so can map from
whatever name you care to define, then the safer and more proper thing
would be to just use the OID name even in SAML1, e.g.<br><br>
<resolver:AttributeDefinition xsi:type="ad:Simple" id="memberOf"
sourceAttributeID="groupMembership"><br>
<resolver:Dependency ref="myLDAP" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML1String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" /><br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String"
name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" friendlyName="memberOf" /><br>
</resolver:AttributeDefinition><br><br>Of course, if this is
going to be SAML2 only, then you can just ignore that problem and just
have the one SAML2 encoder.<br><br><br>HTH,<br>Rhys.<br>--<br>Dr Rhys
Smith<br>Identity, Access, and Middleware Specialist<br>Cardiff
University & Janet, the UK's research and education network<br><br>email:
<a class="moz-txt-link-abbreviated" href="mailto:smith@cardiff.ac.uk">smith@cardiff.ac.uk</a> / <a class="moz-txt-link-abbreviated" href="mailto:rhys.smith@ja.net">rhys.smith@ja.net</a><br>GPG: 0x4638C985<br><br></div><div><!----><br></div><div>--<br>To
unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div>
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="display:table;width:100%;border-top:1px solid
#EDEEF0;padding-top:5px"> <div
style="display:table-cell;vertical-align:middle;padding-right:6px;"><img
photoaddress="moose@symplicity.com" photoname="Richard Genthner"
src="cid:part3.09010508.04030603@symplicity.com"
name="postbox-contact.jpg" height="25px" width="25px"></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;width:100%">
<a moz-do-not-send="true" href="mailto:moose@symplicity.com"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Richard Genthner</a></div> <div
style="display:table-cell;white-space:nowrap;vertical-align:middle;">
<font color="#9FA2A5"><span style="padding-left:6px">July 18, 2014 at
9:55 AM</span></font></div></div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody">
<meta content="text/html; charset=ISO-8859-1" http-equiv="content-type">
I have been trying to figure out how to expose ldap groups that a user
belongs too. Does anyone have ideas on how to expose these ?<br>
<br>
<div>--<br>To unsubscribe from this list send an email to
<a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></div></div>
</blockquote>
<br>
<div class="moz-signature">-- <br><span><pre wrap="">--
Richard Genthner
Senior System Administrator
<a class="moz-txt-link-abbreviated" href="mailto:rgenthner@symplicity.com">rgenthner@symplicity.com</a>
<span __postbox-detected-content="__postbox-detected-phone" class="__postbox-detected-content __postbox-detected-phone" style="display: inline; font-size: inherit; padding: 0pt; color: rgb(102, 102, 102);">tel. 703-351-0200 x8051
</span>Direct 703-373-7033
<a class="moz-txt-link-freetext" href="sip:8051@voip.symplicity.com">sip:8051@voip.symplicity.com</a>
Symplicity Corporation
<a class="moz-txt-link-freetext" href="http://www.symplicity.com">http://www.symplicity.com</a>
</pre> </span></div>
</body></html>