<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hello all,<o:p></o:p></p><p class=MsoNormal> I'm a bit new Shibboleth and have gotten most of the way set up. I am able to authenticate successfully, but I'm having issues releasing attributes from AD via LDAP using the attribute-resolver.xml and attribute-filter.xml. I've created the Data connector in the Attribute-resolver.xml:<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><resolver:DataConnector id="coastal" xsi:type="dc:LDAPDirectory"<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> principal="%{idp.attribute.resolver.LDAP.bindDN}"<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <dc:FilterTemplate><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <![CDATA[<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> %{idp.attribute.resolver.LDAP.searchFilter}<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> ]]><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </dc:FilterTemplate><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </dc:StartTLSTrustCredential><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </resolver:DataConnector><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal><span style='color:red'>Here’s my ldap.properties file:<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'># LDAP authentication configuration, see authn/ldap-authn-config.xml<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'>## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.authenticator= bindSearchAuthenticator<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'>## Connection properties ##<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>#idp.authn.LDAP.ldapURL= xxxx:389<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.ldapURL= xxxx:389<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>#idp.authn.LDAP.useStartTLS = false<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.useSSL = false<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>#idp.authn.LDAP.connectTimeout = 3000<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'>## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>#idp.authn.LDAP.sslConfig = certificateTrust<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>## If using certificateTrust above, set to the trusted certificate's path<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.trustCertificates= %{idp.home}/credentials/ldap-server.crt<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>## If using keyStoreTrust above, set to the truststore path<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.trustStore= %{idp.home}/credentials/ldap-server.truststore<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'>## Return attributes during authentication<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>## NOTE: this is not used during attribute resolution; configure that directly in the<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>## attribute-resolver.xml configuration via a DataConnector's <dc:ReturnAttributes> element<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.returnAttributes= cn,mail<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'>## DN resolution properties ##<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'># Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'># for AD: CN=Users,DC=example,DC=org<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.baseDN= DC=coastal, DC=edu<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.subtreeSearch = true<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.userFilter= (sAMAccountName={user})<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'># bind search configuration<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'># for AD: <a href="mailto:idp.authn.LDAP.bindDN=adminuser@domain.com">idp.authn.LDAP.bindDN=adminuser@domain.com</a><o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.bindDN= <a href="mailto:xxxx@coastal.edu">xxxx@coastal.edu</a><o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>#idp.authn.LDAP.bindDNCredential= xxxx<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.bindDNCredential= xxxx<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'># Format DN resolution, used by directAuthenticator, adAuthenticator<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'># for AD use <a href="mailto:idp.authn.LDAP.dnFormat=%25s@domain.com">idp.authn.LDAP.dnFormat=%s@domain.com</a><o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.authn.LDAP.dnFormat= <a href="mailto:%25s@coastal.edu">%s@coastal.edu</a><o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:1.0in'># LDAP attribute configuration, see attribute-resolver.xml<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.ldapURL= %{idp.authn.LDAP.ldapURL}<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.baseDN= %{idp.authn.LDAP.baseDN}<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.bindDN= %{idp.authn.LDAP.bindDN}<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.bindDNCredential= %{idp.authn.LDAP.bindDNCredential}<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.useStartTLS= %{idp.authn.LDAP.useStartTLS:true}<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.trustCertificates= %{idp.authn.LDAP.trustCertificates}<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.searchFilter= (uid=$requestContext.principalName)<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'>idp.attribute.resolver.LDAP.returnAttributes = sn,displayName,mail,sAMAccountName<o:p></o:p></p><p class=MsoNormal style='margin-left:1.0in'><o:p> </o:p></p><p class=MsoNormal><span style='color:red'>I've then defined some attributes to be released: <o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><resolver:AttributeDefinition xsi:type="ad:Prescoped" id="eduPersonPrincipalName" sourceAttributeID="cn"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:Dependency ref="coastal" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeEncoder xsi:type="enc:SAML1ScopedString" name="urn:mace:dir:attribute-def:eduPersonPrincipalName" encodeType="false" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeEncoder xsi:type="enc:SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" friendlyName="eduPersonPrincipalName" encodeType="false" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </resolver:AttributeDefinition><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeDefinition xsi:type="ad:Simple" id="sn" sourceAttributeID="sn"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:Dependency ref="coastal" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:sn" encodeType="false" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:2.5.4.4" friendlyName="sn" encodeType="false" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </resolver:AttributeDefinition><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeDefinition id="mail" xsi:type="ad:Simple" sourceAttributeID="mail"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:Dependency ref="coastal" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </resolver:AttributeDefinition><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:red'>In my Attribute-filter.xml I’ve added the entries (I’m testing using the incommon test bed)<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><afp:AttributeFilterPolicy id="Incommon Federation"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="<a href="https://fm.incommon.org/sp">https://fm.incommon.org/sp</a>" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'> <afp:AttributeRule attributeID="eduPersonPrincipalName"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </afp:AttributeRule><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <afp:AttributeRule attributeID="mail"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </afp:AttributeRule><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <afp:AttributeRule attributeID="displayName"><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> <afp:PermitValueRule xsi:type="basic:ANY" /><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </afp:AttributeRule><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'> <o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'> </afp:AttributeFilterPolicy><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>When I log in via the test bed I’m successfully authenticated, but receive no attributes:<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>2016-02-11 14:51:07,594 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:179] - Profile Action ValidateUsernamePasswordAgainstLDAP: <span style='background:yellow;mso-highlight:yellow'>Login by 'mrichter' succeeded</span><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>2016-02-11 14:51:12,062 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'coastal' produced no value.<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>2016-02-11 14:51:12,500 - INFO [Shibboleth-Audit.SSO:241] - 20160211T195112Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_3dc45b2cdb437a697a2bc4e21085e075|https://fm.incommon.org/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://shib1.coastal.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_fb8de51164a0df1a8eb8e3f1d14a2bdf|mrichter|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport||AAdzZWNyZXQxNUWzXq1oYkuk0JwultB0V44+SfEvgjVWhjLysjTMt2F4umkFW8bp2EJ1VEjvIXBdEZ5PEDKkgX2Oosabw9Eu69rNhekwhjic0gMpUpFXhaULSxoGL9OHs2mPhZQyjUBzLw==|_0ad49c4a3bf03d91688ee662da41acd9<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>2016-02-11 14:55:35,082 - INFO <span style='background:yellow;mso-highlight:yellow'>[net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'coastal' produced no value.</span><o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>Any ideas what I’m missing. Again, I’m fairly new to Shibboleth, so sorry if I missed something obvious. I tried to research this pretty extensively before posting. Thanks!<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>Mike<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p></div></body></html>