<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I would leave useStartTLS disabled in ldap.properties as you get started, as you have done. (Before going into production of course you’ll want to have either
that or useSSL enabled.) If you continue having certificate-related problems, you might try removing the StartTLSTrustCredential element from your data connector for the time being. Also note that your idp.authn.LDAP.bindDN is not currently set to the DN of
an account. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You may find the Shibboleth Workshop series documentation to be a very practical guide as you get started, particularly this section.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="https://spaces.internet2.edu/display/ShibInstallFest/Windows+Identity+Provider+IdPv3#WindowsIdentityProviderIdPv3-4.ConfigureUserAuthentication">https://spaces.internet2.edu/display/ShibInstallFest/Windows+Identity+Provider+IdPv3#WindowsIdentityProviderIdPv3-4.ConfigureUserAuthentication</a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Robo Burned<br>
<b>Sent:</b> Wednesday, November 25, 2015 5:28 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Using cn (commonName) as NameID<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin-bottom:12.0pt">I am working on adding data connector to the attribute-resolver.xml I have no success with examples from documentation - they reference non-existing ldap.properties. So I started to workd with example from attribute-resolver-ldap.xml
file<o:p></o:p></p>
<p><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br>
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>
baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br>
principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
%{idp.attribute.resolver.LDAP.searchFilter}<br>
]]><br>
</dc:FilterTemplate><br>
<dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes><br>
<dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked"><br>
<sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><br>
</dc:StartTLSTrustCredential><br>
</resolver:DataConnector><o:p></o:p></p>
<p>As by default, idp.attribute.resolver.LDAP.* properties values are referencing idp.authn.LDAP.* props.<o:p></o:p></p>
<p>The props are quite default except useStartTLS = false. (see all props attached). <o:p></o:p></p>
<p>Now I am getting IllegalArgumentException: name while setting bean property connectionFactory.sslConfig.credentialConfig.'trustCredential<o:p></o:p></p>
<p>Do I need to disable SSL in some way? I see #idp.authn.LDAP.useSSL = false but I see no such setting /attribute for data connector<o:p></o:p></p>
<p><o:p> </o:p></p>
<blockquote style="border:none;border-left:solid #0857A6 1.0pt;padding:0in 0in 0in 8.0pt;margin-left:7.5pt;margin-top:7.5pt;margin-right:7.5pt;margin-bottom:7.5pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">Среда, 25 ноября 2015, 11:34 +01:00 от Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>>:<o:p></o:p></p>
<div id="">
<div>
<div>
<div id="style_14484476750000000419_BODY">
<p class="MsoNormal">* Robo Burned <<a href="/compose?To=robo@list.ru">robo@list.ru</a>> [2015-11-25 10:40]:<br>
> I found the following in docs:<br>
> Attribute Retrieval<br>
> LDAP attributes are returned as part of the authentication process and exposed in the LDAPResponseContext.<br>
> By default, attributes will be searched for using the same connection the user authenticated on.
<br>
> I've added cn to both<br>
> idp.authn.LDAP.returnAttributes= cn,passwordExpirationTime,loginGraceRemaining<br>
> and <br>
> idp.attribute.resolver.LDAP.returnAttributes= cn,homephone,mail<br>
<br>
This is the comment above idp.authn.LDAP.returnAttributes in my<br>
ldap.properties file:<br>
<br>
## Return attributes during authentication<br>
## NOTE: this is not used during attribute resolution; configure that directly in the<br>
## attribute-resolver.xml configuration via a DataConnector's <dc:ReturnAttributes> element<br>
<br>
To just get some data from LDAP into the IDP and release it either as<br>
SAML Attribute or NameID you use the IDP as usual, configuring the<br>
attribute resolver. The IDP ships will many fully functional examples.<br>
Here's the documentation if you prefer to ignore those:<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration</a><br>
<br>
-peter<br>
-- <br>
To unsubscribe from this list send an email to <a href="/compose?To=users%2dunsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
<p><br>
<br>
С уважением,<br>
<br>
Robo Burned<o:p></o:p></p>
</div>
</body>
</html>