<HTML><BODY><p>I am working on adding data connector to the attribute-resolver.xml I have no success with examples from documentation - they reference non-existing ldap.properties. So I started to workd with example from attribute-resolver-ldap.xml file<br><br></p><p> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"><br> <dc:FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </dc:FilterTemplate><br> <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes><br> <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked"><br> <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><br> </dc:StartTLSTrustCredential><br> </resolver:DataConnector><br data-mce-bogus="1"></p><p>As by default, idp.attribute.resolver.LDAP.* properties values are referencing idp.authn.LDAP.* props.</p><p>The props are quite default except useStartTLS = false. (see all props attached). <br data-mce-bogus="1"></p><p>Now I am getting IllegalArgumentException: name while setting bean property connectionFactory.sslConfig.credentialConfig.'trustCredential</p><p>Do I need to disable SSL in some way? I see #idp.authn.LDAP.useSSL = false but I see no such setting /attribute for data connector<br data-mce-bogus="1"></p><p><br data-mce-bogus="1"></p><blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;">
Среда, 25 ноября 2015, 11:34 +01:00 от Peter Schober <peter.schober@univie.ac.at>:<br>
<br>
<div id="">
<div class="js-helper js-readmsg-msg">
<div>
<div id="style_14484476750000000419_BODY">* Robo Burned <<a href="/compose?To=robo@list.ru">robo@list.ru</a>> [2015-11-25 10:40]:<br>
> I found the following in docs:<br>
> Attribute Retrieval<br>
> LDAP attributes are returned as part of the authentication process and exposed in the LDAPResponseContext.<br>
> By default, attributes will be searched for using the same connection the user authenticated on. <br>
> I've added cn to both<br>
> idp.authn.LDAP.returnAttributes= cn,passwordExpirationTime,loginGraceRemaining<br>
> and <br>
> idp.attribute.resolver.LDAP.returnAttributes= cn,homephone,mail<br>
<br>
This is the comment above idp.authn.LDAP.returnAttributes in my<br>
ldap.properties file:<br>
<br>
## Return attributes during authentication<br>
## NOTE: this is not used during attribute resolution; configure that directly in the<br>
## attribute-resolver.xml configuration via a DataConnector's <dc:ReturnAttributes> element<br>
<br>
To just get some data from LDAP into the IDP and release it either as<br>
SAML Attribute or NameID you use the IDP as usual, configuring the<br>
attribute resolver. The IDP ships will many fully functional examples.<br>
Here's the documentation if you prefer to ignore those:<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration</a><br>
<br>
-peter<br>
-- <br>
To unsubscribe from this list send an email to <a href="/compose?To=users%2dunsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</div>
</div>
</blockquote><p>
<br>
<br>С уважением,<br> <br>Robo Burned<br></p></BODY></HTML>