<div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif">No, I think he means there needs to be one less.<br><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">This:<br></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br><span class="im">(sAMAccountName=${krb_principalname.get(0)}<br>(!(userAccountControl:1.2.840.113556.1.4.803:=2)))<br><br></span></div><div class="gmail_default" style="font-family:verdana,sans-serif"><span class="im">instead of this:<br></span></div><div class="gmail_default" style="font-family:verdana,sans-serif"><br><span class="im">(|(sAMAccountName=${krb_principalname.get(0)})<br>(!(userAccountControl:1.2.840.113556.1.4.803:=2))))<br><br><br></span></div><div class="gmail_default" style="font-family:verdana,sans-serif"><span class="im">John<br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Nov 25, 2014 at 7:32 AM, Morris, Andi <span dir="ltr"><<a href="mailto:amorris@cardiffmet.ac.uk" target="_blank">amorris@cardiffmet.ac.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Interesting. It seems to be working as it is. Where would you put the extra | ?<br>
<span class=""><br>
-----Original Message-----<br>
From: <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] On Behalf Of Douglas E Engert<br>
</span><span class="">Sent: 25 November 2014 13:05<br>
To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
Subject: Re: Mapping kerberos principal to ldap connector<br>
<br>
<br>
<br>
</span><div><div class="h5">On 11/25/2014 3:23 AM, Morris, Andi wrote:<br>
> Thanks Douglas,<br>
> I think I've resolved this now by using the below. I've also put in the check for a disabled account that you mentioned in a previous thread.<br>
><br>
> <dc:FilterTemplate><br>
> <![CDATA[<br>
><br>
> (&(objectClass=user)(|(sAMAccountName=${krb_principalname.get(0)})(!(u<br>
> serAccountControl:1.2.840.113556.1.4.803:=2))))<br>
^^ ^<br>
<br>
Looks like an extra "(| ... )" in the filter that would allow any any active user account to work.<br>
<br>
<br>
> ]]><br>
> </dc:FilterTemplate><br>
> <dc:LDAPProperty name="java.naming.referral" value="follow"/><br>
><br>
> That seems to be pulling AD attributes now.<br>
><br>
> Cheers,<br>
> Andi<br>
><br>
> -----Original Message-----<br>
> From: <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a><br>
> [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>] On Behalf Of Douglas E Engert<br>
> Sent: 24 November 2014 18:14<br>
> To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
> Subject: Re: Mapping kerberos principal to ldap connector<br>
><br>
><br>
><br>
> On 11/24/2014 9:24 AM, Morris, Andi wrote:<br>
>> Hi all,<br>
>><br>
>> Kerberos authentication is now working well, and transparently through RemoteUser.<br>
>><br>
>> However I've now come to try to map some attributes to send and I'm<br>
>> using <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler+-+Attribute+resolver" target="_blank">https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler+-+Attribute+resolver</a> to do this within attribute-resolver.xml.<br>
>><br>
>> Modifying this for my own environment I have:<br>
>><br>
>> ---------------------------------------------------------------------<br>
>> -<br>
>> --------------------------------------------------------<br>
>><br>
>> <resolver:AttributeDefinition id="principalName"<br>
>><br>
>> xsi:type="ad:PrincipalName"<br>
>><br>
>> dependencyOnly="true"><br>
>><br>
>> </resolver:AttributeDefinition><br>
>><br>
>> <resolver:AttributeDefinition id="krb_principalname"<br>
>><br>
>> xsi:type="ad:Mapped"<br>
>><br>
>> sourceAttributeID="principalName"<br>
>><br>
>> dependencyOnly="true" ><br>
>><br>
>> <resolver:Dependency ref="principalName" /><br>
>><br>
>> <ad:ValueMap><br>
>><br>
>> <ad:ReturnValue>$1</ad:ReturnValue><br>
>><br>
>><br>
>> <ad:SourceValue>(.+)@<a href="http://INTERNAL.DOMAIN.AC.UK" target="_blank">INTERNAL.DOMAIN.AC.UK</a></ad:SourceValue><br>
>><br>
>> </ad:ValueMap><br>
>><br>
>> </resolver:AttributeDefinition><br>
>><br>
>> <resolver:AttributeDefinition id="krb_domain"<br>
>><br>
>> xsi:type="ad:Mapped"<br>
>><br>
>> sourceAttributeID="principalName"<br>
>><br>
>> dependencyOnly="true" ><br>
>><br>
>> <resolver:Dependency ref="principalName" /><br>
>><br>
>> <ad:ValueMap><br>
>><br>
>> <ad:ReturnValue><a href="http://internal.uwic.ac.uk" target="_blank">internal.uwic.ac.uk</a></ad:ReturnValue><br>
>><br>
>><br>
>> <ad:SourceValue>(.+)@<a href="http://INTERNAL.DOMAIN.AC.UK" target="_blank">INTERNAL.DOMAIN.AC.UK</a></ad:SourceValue><br>
>><br>
>> </ad:ValueMap><br>
>><br>
>> </resolver:AttributeDefinition><br>
>><br>
>> <resolver:DataConnector id="myLDAP"<br>
>><br>
>> xsi:type="dc:LDAPDirectory"<br>
>><br>
>> ldapURL="ldap://<a href="http://ldap.internal.domain.ac.uk" target="_blank">ldap.internal.domain.ac.uk</a>"<br>
>><br>
>> baseDN="ou=User Accounts,dc=internal,dc=domain,dc=ac,dc=uk"<br>
>><br>
>> principal="<a href="mailto:shib@internal.domain.ac.uk">shib@internal.domain.ac.uk</a> <mailto:<a href="mailto:shib@internal.domain.ac.uk">shib@internal.domain.ac.uk</a>>"<br>
>><br>
>> principalCredential="password"><br>
>><br>
>> <resolver:Dependency ref="krb_principalname" /><br>
>><br>
>> <resolver:Dependency ref="krb_domain" /><br>
>><br>
>> <dc:FilterTemplate><br>
>><br>
>> <!--<br>
>><br>
>> (mail=$requestContext.principalName) - matches UsernamePassword<br>
>> Principal<br>
>><br>
>> &(samaccountname=${})(msSFU30NisDomain=${}) - matches Kerberos<br>
>> Principal<br>
>><br>
>> --><br>
>><br>
>> <![CDATA[<br>
>><br>
>><br>
>> (&(|(mail=$requestContext.principalName)(&(samaccountname=${krb_princ<br>
>> i<br>
>> palname.get(0)})(msSFU30NisDomain=${krb_domain.get(0)})))(objectclass<br>
>> =<br>
>> user))<br>
>><br>
>> ]]><br>
>><br>
>> </dc:FilterTemplate><br>
>><br>
>> <dc:LDAPProperty name="java.naming.referral"<br>
>> value="follow"/><br>
>><br>
>> </resolver:DataConnector><br>
><br>
> Wow, that is a weird example they have, expecting the msSFU30NisDomain to match the krb_realm.<br>
><br>
> If AD is acting as the KDC, then the Kerberos realm name is the uppercase of the AD domain name.<br>
> (Kerberos protocols and applications are case sensitive, AD is not, so this can cause confusion too.) In general you can search for <sAMAccountName>@<AD-DOMAIN-NAME>.<br>
> userPrincipalName at one time could be used, but AD overloaded it, for<br>
> smart card/certificate use as subjectAltName:msUPN.)<br>
><br>
> It might work in your environment, if the AD admins have populated msSFU30BisDomain, and have turned on SFU.<br>
><br>
> Also in general, there is no guarantee that the mail attribute will match the kerberos principal name.<br>
><br>
> One way to see what gets returned is use the Unix ldapsearch command to see what LDAP returns.<br>
><br>
> A lot of the msDS attributes are not returned by AD by default. Not sure if msSFU30NisDomain is.<br>
> Best bet is to list the attributes you want returnedsomething like:<br>
> <dc:ReturnAttributes><br>
> sAMAccountName sn givenName displayName mail cn entryDN userPrincipalName<br>
> </dc:ReturnAttributes><br>
><br>
>><br>
>> ---------------------------------------------------------------------<br>
>> -<br>
>> --------------------------------------------------<br>
>><br>
>> Debug output shows:<br>
>><br>
>> ---------------------------------------------------------------------<br>
>> -<br>
>> ------------------------------------------------<br>
>><br>
>> 15:05:25.103 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:478] - Resolving attributes for principal '<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>' for SAML request from relying party '<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/shibboleth-sp</a>'<br>
>><br>
>> 15:05:25.103 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</div></div>>> e r.ShibbolethAttributeResolver:119] - shibboleth.AttributeResolver<br>
<span class="">>> resolving attributes for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.103 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:275] - Specific attributes for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>> were not requested, resolving all attributes.<br>
>><br>
>> 15:05:25.103 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:314] - Resolving attribute<br>
<span class="">>> eduPersonScopedAffiliation for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.103 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:354] - Resolving data connector<br>
<span class="">>> myLDAP for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.104 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:314] - Resolving attribute<br>
<span class="">>> krb_principalname for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.104 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:314] - Resolving attribute<br>
<span class="">>> principalName for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.104 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:25.104 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.attributeDefinition.MappedAttributeDefinition:97] - Attribute<br>
<span class="">>> Definition krb_principalname: mapping depdenency attribute value<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.104 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:84] - Attempting to map attribute value '<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>'<br>
>><br>
>> 15:05:25.105 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.attributeDefinition.ValueMap:99] - Performing regular expression<br>
<span class="">>> based comparison<br>
>><br>
>> 15:05:25.106 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:105] - Attribute value '<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>' matches regular expression it will be mapped to 'username'<br>
>><br>
>> 15:05:25.106 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.attributeDefinition.MappedAttributeDefinition:119] - Attribute<br>
<span class="">>> Definition krb_principalname: mapped depdenency attribute value<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>> to the values [username]<br>
>><br>
>> 15:05:25.106 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> krb_principalname containing 1 values<br>
>><br>
>> 15:05:25.106 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:314] - Resolving attribute krb_domain<br>
<span class="">>> for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.106 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:25.107 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.attributeDefinition.MappedAttributeDefinition:97] - Attribute<br>
<span class="">>> Definition krb_domain: mapping depdenency attribute value<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:25.107 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:84] - Attempting to map attribute value '<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>'<br>
>><br>
>> 15:05:25.107 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.attributeDefinition.ValueMap:99] - Performing regular expression<br>
<span class="">>> based comparison<br>
>><br>
>> 15:05:25.107 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.ValueMap:105] - Attribute value '<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>' matches regular expression it will be mapped to '<a href="http://internal.DOMAIN.ac.uk" target="_blank">internal.DOMAIN.ac.uk</a>'<br>
>><br>
>> 15:05:25.107 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.attributeDefinition.MappedAttributeDefinition:119] - Attribute<br>
<span class="">>> Definition krb_DOMAIN: mapped depdenency attribute value<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>> to the values [<a href="http://internal.DOMAIN.ac.uk" target="_blank">internal.DOMAIN.ac.uk</a>]<br>
>><br>
>> 15:05:25.107 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN<br>
<span class="">>> containing 1 values<br>
>><br>
>> 15:05:25.109 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:308] - Search filter:<br>
>> (&(|(mail=<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>)(&(samaccountname=username)(<br>
>> m<br>
>> sSFU30Nisdomain=<a href="http://internal.domain.ac.uk" target="_blank">internal.domain.ac.uk</a>)))(objectclass=user))<br>
>> <mailto:<a href="mailto:mail">mail</a>=<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>)(&(samaccountname=usernam<br>
</span>>> e )(msSFU30Nisdomain=<a href="http://internal.domain.ac.uk" target="_blank">internal.domain.ac.uk</a>)))(objectclass=user))><br>
<span class="">>><br>
>> 15:05:25.109 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.dataConnector.LdapDataConnector:363] - LDAP data connector myLDAP<br>
<span class="">>> - Retrieving attributes from LDAP<br>
>><br>
>> 15:05:30.118 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> eduPersonScopedAffiliation containing 0 values<br>
>><br>
>> 15:05:30.118 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:314] - Resolving attribute<br>
<span class="">>> transientId for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.119 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.attributeDefinition.TransientIdAttributeDefinition:97] - Building transient ID for request _75254f2685bd3e67f7856ebaf4b93743; outbound message issuer: <a href="https://idp.dev.cardiffmet.ac.uk/idp/shibboleth" target="_blank">https://idp.dev.cardiffmet.ac.uk/idp/shibboleth</a>, inbound message issuer: <a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/shibboleth-sp</a>, principal identifer:<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.119 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.attributeDefinition.TransientIdAttributeDefinition:115] - Created<br>
<span class="">>> transient ID<br>
>> _5f54a61906da93f401e5905676bf8874 for request<br>
>> _75254f2685bd3e67f7856ebaf4b93743<br>
>><br>
>> 15:05:30.119 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute transientId<br>
<span class="">>> containing 1 values<br>
>><br>
>> 15:05:30.119 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:314] - Resolving attribute<br>
<span class="">>> eduPersonTargetedID for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.119 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:354] - Resolving data connector<br>
<span class="">>> computedID for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.119 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:30.120 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> krb_principalname containing 1 values<br>
>><br>
>> 15:05:30.120 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:30.121 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN<br>
<span class="">>> containing 1 values<br>
>><br>
>> 15:05:30.121 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.dataConnector.ComputedIDDataConnector:121] - Source attribute<br>
<span class="">>> sAMAccountName for connector computedID provide no values<br>
><br>
><br>
> Looks like SAMAccountName was not returned... See above.<br>
><br>
>><br>
>> 15:05:30.121 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> eduPersonTargetedID containing 0 values<br>
>><br>
>> 15:05:30.121 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:30.121 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> krb_principalname containing 1 values<br>
>><br>
>> 15:05:30.122 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:314] - Resolving attribute<br>
<span class="">>> eduPersonPrincipalName for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.122 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:30.122 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> krb_principalname containing 1 values<br>
>><br>
>> 15:05:30.122 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:30.126 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN<br>
<span class="">>> containing 1 values<br>
>><br>
>> 15:05:30.126 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> eduPersonPrincipalName containing 0 values<br>
>><br>
>> 15:05:30.127 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:30.129 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute<br>
<span class="">>> principalName containing 1 values<br>
>><br>
>> 15:05:30.129 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:336] - Resolved attribute krb_DOMAIN<br>
<span class="">>> containing 1 values<br>
>><br>
>> 15:05:30.129 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:455] - Removing attribute eduPersonScopedAffiliation from resolution result for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>. It contains no values.<br>
>><br>
>> 15:05:30.130 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:473] - Attribute transientId has 1<br>
<span class="">>> values after post-processing<br>
>><br>
>> 15:05:30.130 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:455] - Removing attribute eduPersonTargetedID from resolution result for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>. It contains no values.<br>
>><br>
>> 15:05:30.130 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:447] - Removing dependency-only attribute krb_principalname from resolution result for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>.<br>
>><br>
>> 15:05:30.130 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:455] - Removing attribute eduPersonPrincipalName from resolution result for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>. It contains no values.<br>
>><br>
>> 15:05:30.130 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:447] - Removing dependency-only attribute principalName from resolution result for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>.<br>
>><br>
>> 15:05:30.130 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:447] - Removing dependency-only attribute krb_DOMAIN from resolution result for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>.<br>
>><br>
>> 15:05:30.131 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provid<br>
</span>>> e r.ShibbolethAttributeResolver:137] - shibboleth.AttributeResolver<br>
<span class="">>> resolved, for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>, the attributes:<br>
>> [transientId]<br>
>><br>
>> 15:05:30.131 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:71] -<br>
<span class="">>> shibboleth.AttributeFilterEngine filtering 1 attributes for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.131 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter<br>
<span class="">>> policy releaseTransientIdToAnyone is active for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.132 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:139] - Filter policy<br>
<span class="">>> releaseTransientIdToAnyone is active for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.135 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:163] - Processing permit<br>
<span class="">>> value rule for attribute transientId for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.135 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:130] - Evaluating if filter<br>
<span class="">>> policy releaseBasicAttributesToAnyone is active for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.135 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:139] - Filter policy<br>
<span class="">>> releaseBasicAttributesToAnyone is active for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.138 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:163] - Processing permit<br>
<span class="">>> value rule for attribute eduPersonScopedAffiliation for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.138 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:163] - Processing permit<br>
<span class="">>> value rule for attribute eduPersonAffiliation for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.138 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:163] - Processing permit<br>
<span class="">>> value rule for attribute eduPersonTargetedID for principal<br>
>> <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>><br>
>><br>
>> 15:05:30.138 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:109] - Attribute transientId<br>
<span class="">>> has<br>
>> 1 values after filtering<br>
>><br>
>> 15:05:30.138 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.filtering.provi<br>
</span>>> d er.ShibbolethAttributeFilteringEngine:114] - Filtered attributes<br>
<span class="">>> for principal <a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a><br>
>> <mailto:<a href="mailto:username@INTERNAL.DOMAIN.AC.UK">username@INTERNAL.DOMAIN.AC.UK</a>>. The following attributes<br>
>> remain: [transientId]<br>
>><br>
>> 15:05:30.139 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:505] - Creating attribute statement in response to SAML request '_75254f2685bd3e67f7856ebaf4b93743' from relying party '<a href="https://sp.testshib.org/shibboleth-sp" target="_blank">https://sp.testshib.org/shibboleth-sp</a>'<br>
>><br>
>> 15:05:30.139 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority:263] - Attribute transientId was not encoded (filtered by query, or no SAML2AttributeEncoder attached).<br>
>><br>
>> 15:05:30.139 - DEBUG<br>
>> [edu.internet2.middleware.shibboleth.common.attribute.provider.Shibbo<br>
</span>>> l ethSAML2AttributeAuthority:129] - No attributes remained after<br>
<div class="HOEnZb"><div class="h5">>> encoding and filtering by value, no attribute statement built<br>
>><br>
>> ---------------------------------------------------------------------<br>
>> -<br>
>> --------------------------------------------<br>
>><br>
>> I can see that the krb_principalname and krb_domain get mapped to the<br>
>> correct parts of the principal, but I'm having trouble then passing that to the LDAP connector. I think it's something up with the search filter.<br>
>><br>
>> Can anybody please point me in the right direction here:<br>
>><br>
>> Cheers,<br>
>><br>
>> Andi<br>
>><br>
>><br>
>><br>
><br>
<br>
--<br>
<br>
Douglas E. Engert <<a href="mailto:DEEngert@gmail.com">DEEngert@gmail.com</a>><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>