<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">Just to close the loop on this. Thanks for all the suggestions and examples! They definitely helped me in configuring it the way I needed it.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I was able to merge the attributes using a script in the attribute-resolver.xml file.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The problem I ran into was with Java 8. In the idp-process.log file I would see this:<o:p></o:p></p>
<p class="MsoPlainText"><span style="font-size:9.0pt">2015-10-15 14:30:26,853 - ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:256] - Profile Action ResolveAttributes: Error resolving attributes<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:9.0pt">net.shibboleth.idp.attribute.resolver.ResolutionException: Attribute Definition 'eduPersonPrincipalName': unable to execute script<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:9.0pt"> at net.shibboleth.idp.attribute.resolver.ad.impl.ScriptedAttributeDefinition.doAttributeDefinitionResolve(ScriptedAttributeDefinition.java:148)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:9.0pt">Caused by: javax.script.ScriptException: ReferenceError: "importPackage" is not defined in <eval> at line number 1<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:9.0pt"> at jdk.nashorn.api.scripting.NashornScriptEngine.throwAsScriptException(NashornScriptEngine.java:455)<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:9.0pt">Caused by: jdk.nashorn.internal.runtime.ECMAException: ReferenceError: "importPackage" is not defined<o:p></o:p></span></p>
<p class="MsoPlainText"><span style="font-size:9.0pt"> at jdk.nashorn.internal.runtime.ECMAErrors.error(ECMAErrors.java:57)<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">After I uninstalled Java 8 U 45 and installed Java 7 U 79, everything worked fine with the script.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks again for all the assistance,<o:p></o:p></p>
<p class="MsoPlainText">Joe<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: users [mailto:users-bounces@shibboleth.net] On Behalf Of Douglas E Engert<br>
Sent: Wednesday, October 14, 2015 7:01 PM<br>
To: users@shibboleth.net<br>
Subject: Re: Two AD data connectors issue with Attribute-resolver</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">You may need a three resolvers something like this:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <resolver:AttributeDefinition id="AD1eduPersonPrincipalName" xsi:type="ad:Prescoped" sourceAttributeID="mail"><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:Dependency ref="AD1" /><o:p></o:p></p>
<p class="MsoPlainText"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <resolver:AttributeDefinition id="AD3eduPersonPrincipalName" xsi:type="ad:Prescoped" sourceAttributeID="mail"><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:Dependency ref="AD3" /><o:p></o:p></p>
<p class="MsoPlainText"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <resolver:AttributeDefinition id="eduPersonPrincipalName" xsi:type="Script" ... ><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:Dependency ref="AD1eduPersonPrincipalName" /><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:Dependency ref="AD3eduPersonPrincipalName" /><o:p></o:p></p>
<p class="MsoPlainText"> <Script><![CDATA[<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> pick one, resolve conflicts if both exist and not the same...<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> ]]></Script><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" /><o:p></o:p></p>
<p class="MsoPlainText"> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" /><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> </resolver:AttributeDefinition><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 10/14/2015 3:09 PM, Cantor, Scott wrote:<o:p></o:p></p>
<p class="MsoPlainText">> On 10/14/15, 4:00 PM, "users on behalf of Colon, Joseph" <<a href="mailto:users-bounces@shibboleth.net%20on%20behalf%20of%20JColon@APUS.EDU"><span style="color:windowtext;text-decoration:none">users-bounces@shibboleth.net on behalf
of JColon@APUS.EDU</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">>> Thanks for the info Scott,<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> So if I have 2 domains, AD1 and AD3. Is there any way to return an attribute like "mail" back to the SP no matter which domain the user exists in?<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> There are usually a dozen ways to do anything with the resolver. Failover connectors running in sequence is one way, another would be using separate attributes from each domain and then merging the results together.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> -- Scott<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-- <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> Douglas E. Engert <<a href="mailto:DEEngert@gmail.com"><span style="color:windowtext;text-decoration:none">DEEngert@gmail.com</span></a>><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-- <o:p></o:p></p>
<p class="MsoPlainText">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
<span style="color:windowtext;text-decoration:none">users-unsubscribe@shibboleth.net</span></a><o:p></o:p></p>
</div>
<p>This message is private and confidential. If you have received it in error, please notify the sender and remove it from your system.</p></body>
</html>