<html><head></head><body><div>Thanks for the tip! Turns out I was confused of the use of the config files. I was putting these things in attribute-resolver-ldap.xml rather than attribute-resolver.xml Having put them into the right place they now work as expected.</div><div><br></div><div>Brandon McKean</div><div><br></div><div>On Thu, 2015-06-25 at 21:53 +0200, Peter Schober wrote:</div><blockquote type="cite"><pre>* McKean, Brandon Scott - mckeanbs <<a href="mailto:mckeanbs@jmu.edu">mckeanbs@jmu.edu</a>> [2015-06-25 21:46]:

<blockquote type="cite">

The first one being the mail attribute definition. I see it's set to

construct that from the uid and add a domain of your choosing, but I

was hoping to get that pulled straight from LDAP. Is there a way to

do that?

</blockquote>

Sure, if the software couldn't pass around email addresses, but only

uids, that would be pretty broken.

<blockquote type="cite">

<resolver:AttributeDefinition id="mail" xsi:type="ad:Simple">

<resolver:AttributeEncoder xsi:type="enc:SAML1String"

name="urn:mace:dir:attribute-def:mail" encodeType="false" />

<resolver:AttributeEncoder xsi:type="enc:SAML2String"

name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail"

encodeType="false" />

</resolver:AttributeDefinition>

</blockquote>

Your previously sent version looked better, as it included

sourceAttributeID="mail" in the AttributeDefinition and a child

element of <resolver:Dependency ref="jmuad" /> referencing the

DataConnector that should be able to provide the "mail" attribute.

They're both missing from your example above.

But do consult the documentation, for IDPv3 it's this (or something in

that vicinity):

<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration</a>

-peter

</pre></blockquote></body></html>