<HTML><BODY><p>I am setting up testing environment so secruity does not matter.<br data-mce-bogus="1"></p><p>I removed
<span style="font-size:11.0pt;font-family:'Calibri',sans-serif;color:#1F497D">StartTLSTrustCredential</span> from resolver:DataConnector and now get the following error:<br data-mce-bogus="1"></p><p>You said my Bind DN configuration is incorrect. I don't understand what are bind, base DNs are.<br>Caused by: javax.naming.OperationNotSupportedException: [LDAP: error code 53 - UNWILLING_TO_PERFORM: Bind failed: Cannot Bind for Dn OU=MSKCC_Users, DC=mskcc, DC=dom]<br></p><p>I am not sure why the same DN works with authentication and does not work for attribute resolution. However I changed DN settings to the following (Default for Apache DS)<br>idp.authn.LDAP.bindDN= uid=admin, ou=system<br>idp.authn.LDAP.bindDNCredential= secret<br data-mce-bogus="1"></p><p>And... got no attributes: search returns no entities.</p><p>In logs I see<br data-mce-bogus="1"></p><p>2015-11-25 20:20:52,061 - DEBUG [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.TemplatedExecutableSearchFilterBuilder:212] - Template text (uid=$(resolutionContext.principal)) yields (uid=$(resolutionContext.principal))<br data-mce-bogus="1"></p><p>I changed config to the following:<br data-mce-bogus="1"></p><p><strong>idp.attribute.resolver.LDAP.searchFilter= (uid=$requestContext.principalName)</strong></p><p>And now it works!<br data-mce-bogus="1"></p><p>Great thank you for assistence!<br data-mce-bogus="1"></p><blockquote style="border-left:1px solid #0857A6; margin:10px; padding:0 0 0 10px;">
Среда, 25 ноября 2015, 12:52 UTC от "Doan, Tommy" <tdoan@smu.edu>:<br>
<br>
<div id="">
<div class="js-helper js-readmsg-msg">
<div>
<div id="style_14484559640000000145_BODY">
<div>
<p><span style="font-size:11.0pt;font-family:'Calibri',sans-serif;color:#1F497D">I would leave useStartTLS disabled in ldap.properties as you get started, as you have done. (Before going into production of course you’ll want to have either
that or useSSL enabled.) If you continue having certificate-related problems, you might try removing the StartTLSTrustCredential element from your data connector for the time being. Also note that your idp.authn.LDAP.bindDN is not currently set to the DN of
an account. </span></p>
<p><span style="font-size:11.0pt;font-family:'Calibri',sans-serif;color:#1F497D"> </span></p>
<p><span style="font-size:11.0pt;font-family:'Calibri',sans-serif;color:#1F497D">You may find the Shibboleth Workshop series documentation to be a very practical guide as you get started, particularly this section.
</span></p>
<p><span style="font-size:11.0pt;font-family:'Calibri',sans-serif;color:#1F497D"><a href="https://spaces.internet2.edu/display/ShibInstallFest/Windows+Identity+Provider+IdPv3#WindowsIdentityProviderIdPv3-4.ConfigureUserAuthentication" target="_blank">https://spaces.internet2.edu/display/ShibInstallFest/Windows+Identity+Provider+IdPv3#WindowsIdentityProviderIdPv3-4.ConfigureUserAuthentication</a>
</span></p>
<p><span style="font-size:11.0pt;font-family:'Calibri',sans-serif;color:#1F497D"> </span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p><b><span style="font-size:11.0pt;font-family:'Calibri',sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:'Calibri',sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Robo Burned<br>
<b>Sent:</b> Wednesday, November 25, 2015 5:28 AM<br>
<b>To:</b> Shib Users <<a href="/compose?To=users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Using cn (commonName) as NameID</span></p>
</div>
</div>
<p> </p>
<p style="margin-bottom:12.0pt">I am working on adding data connector to the attribute-resolver.xml I have no success with examples from documentation - they reference non-existing ldap.properties. So I started to workd with example from attribute-resolver-ldap.xml
file</p>
<p><resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"<br>
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>
baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br>
principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"><br>
<dc:FilterTemplate><br>
<![CDATA[<br>
%{idp.attribute.resolver.LDAP.searchFilter}<br>
]]><br>
</dc:FilterTemplate><br>
<dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes><br>
<dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked"><br>
<sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><br>
</dc:StartTLSTrustCredential><br>
</resolver:DataConnector></p>
<p>As by default, idp.attribute.resolver.LDAP.* properties values are referencing idp.authn.LDAP.* props.</p>
<p>The props are quite default except useStartTLS = false. (see all props attached). </p>
<p>Now I am getting IllegalArgumentException: name while setting bean property connectionFactory.sslConfig.credentialConfig.'trustCredential</p>
<p>Do I need to disable SSL in some way? I see #idp.authn.LDAP.useSSL = false but I see no such setting /attribute for data connector</p>
<p> </p>
<blockquote style="border:none;border-left:solid #0857A6 1.0pt;padding:0in 0in 0in 8.0pt;margin-left:7.5pt;margin-top:7.5pt;margin-right:7.5pt;margin-bottom:7.5pt">
<p style="margin-bottom:12.0pt">Среда, 25 ноября 2015, 11:34 +01:00 от Peter Schober <<a href="//e.mail.ru/compose/?mailto=mailto%3apeter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>>:</p>
<div>
<div>
<div>
<div>
<p>* Robo Burned <<a target="_blank">robo@list.ru</a>> [2015-11-25 10:40]:<br>
> I found the following in docs:<br>
> Attribute Retrieval<br>
> LDAP attributes are returned as part of the authentication process and exposed in the LDAPResponseContext.<br>
> By default, attributes will be searched for using the same connection the user authenticated on.
<br>
> I've added cn to both<br>
> idp.authn.LDAP.returnAttributes= cn,passwordExpirationTime,loginGraceRemaining<br>
> and <br>
> idp.attribute.resolver.LDAP.returnAttributes= cn,homephone,mail<br>
<br>
This is the comment above idp.authn.LDAP.returnAttributes in my<br>
ldap.properties file:<br>
<br>
## Return attributes during authentication<br>
## NOTE: this is not used during attribute resolution; configure that directly in the<br>
## attribute-resolver.xml configuration via a DataConnector's <dc:ReturnAttributes> element<br>
<br>
To just get some data from LDAP into the IDP and release it either as<br>
SAML Attribute or NameID you use the IDP as usual, configuring the<br>
attribute resolver. The IDP ships will many fully functional examples.<br>
Here's the documentation if you prefer to ignore those:<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeDefinitionConfiguration</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/DataConnectorConfiguration</a><br>
<br>
-peter<br>
-- <br>
To unsubscribe from this list send an email to <a target="_blank">
users-unsubscribe@shibboleth.net</a></p>
</div>
</div>
</div>
</div>
</blockquote>
<p><br>
<br>
С уважением,<br>
<br>
Robo Burned</p>
</div>
</div>
<div>-- <br>
To unsubscribe from this list send an email to <a href="/compose?To=users%2dunsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</div>
</div>
</blockquote><p>
<br>
<br>С уважением,<br> <br>Robo Burned<br></p></BODY></HTML>