<div dir="ltr">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"></blockquote><span class=""> </span><span class=""><</span><span class="">resolver</span><span class="">:</span><span class="">AttributeDefinition </span><span class="">id</span><span class="">=</span><span class="">"UDCID"</span><span class=""> </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"Script"</span><span class=""> </span><span class="">xmlns</span><span class="">=</span><span class="">"urn:mace:shibboleth:2.0:resolver:ad"</span><span class="">></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><</span><span class="">resolver</span><span class="">:</span><span class="">Dependency </span><span class="">ref</span><span class="">=</span><span class="">"myLDAP"</span><span class=""> /></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><</span><span class="">resolver</span><span class="">:</span><span class="">Dependency </span><span class="">ref</span><span class="">=</span><span class="">"uaADLDAP"</span><span class=""> /></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><</span><span class="">resolver</span><span class="">:</span><span class="">Dependency </span><span class="">ref</span><span class="">=</span><span class="">"EDIRemployeeNumber"</span><span class=""> /></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><</span><span class="">resolver</span><span class="">:</span><span class="">Dependency </span><span class="">ref</span><span class="">=</span><span class="">"ADemployeeNumber"</span><span class=""> /></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><</span><span class="">resolver</span><span class="">:</span><span class="">AttributeEncoder </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"SAML1String"</span><span class=""> </span><span class="">xmlns</span><span class="">=</span><span class="">"urn:mace:shibboleth:2.0:attribute:encoder"</span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class="">name</span><span class="">=</span><span class="">"<a href="https://iam.alaska.edu/trac/wiki/IamUaArp#UDCID">https://iam.alaska.edu/trac/wiki/IamUaArp#UDCID</a>"</span><span class=""> /></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><</span><span class="">resolver</span><span class="">:</span><span class="">AttributeEncoder </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"SAML2String"</span><span class=""> </span><span class="">xmlns</span><span class="">=</span><span class="">"urn:mace:shibboleth:2.0:attribute:encoder"</span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class="">name</span><span class="">=</span><span class="">"<a href="https://iam.alaska.edu/trac/wiki/IamUaArp#UDCID">https://iam.alaska.edu/trac/wiki/IamUaArp#UDCID</a>"</span><span class=""> </span><span class="">friendlyName</span><span class="">=</span><span class="">"UDCID"</span><span class=""> /></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><!-- Script attempts to provide UDCID if AD and/or EDIR return value of employeeNumber --><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><!-- If neither directory has a value in the attribute for UDCID, UDCID will have null value and not be released --><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><!-- Script presumes employeeNumber is single-valued directory attribute in edir and AD --><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><!-- debug-level log messages contain directory values and final attribute value--><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><Script></span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class=""><![</span><span class="">CDATA</span><span class="">[</span><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> <br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> importPackage(Packages.edu.internet2.middleware.shibboleth.common.attribute.provider);<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> importPackage(Packages.org.slf4j);<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> logger = LoggerFactory.getLogger("edu.internet2.middleware.shibboleth.resolver.Script.scriptTest");<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> logger.debug("Starting UDCID Attribute Resolver Script:");<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> if (UDCID == null) <br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> {UDCID = new BasicAttribute("UDCID");}<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> <!-- If there is a value of employeeNumber from AD, use that for UDCID --><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> if (typeof ADemployeeNumber != "undefined" && ADemployeeNumber != null && ADemployeeNumber.getValues().size() !=0)<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> { logger.debug("UA AD LDAP UDCID Values: " + ADemployeeNumber.getValues());<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> UDCID.getValues().add(ADemployeeNumber.getValues().get(0))<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> }<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> <!-- If there isn't a value of employeeNumber from AD, use a value from EDIR --><br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> else<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> { if (typeof EDIRemployeeNumber != "undefined" && EDIRemployeeNumber != null && EDIRemployeeNumber.getValues().size() !=0)<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> { logger.debug("Oracle (EDIR) LDAP UDCID Values: " + EDIRemployeeNumber.getValues());<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> UDCID.getValues().add(EDIRemployeeNumber.getValues().get(0))<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> }<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> }<br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote> logger.debug("Completed UDCID value: " + UDCID.getValues()); <br><blockquote class="gmail_quote " style="margin:0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;border-right-width:1px;border-right-color:rgb(204,204,204);border-right-style:solid;padding-left:1ex;padding-right:1ex"></blockquote><span class=""> </span><span class="">]]></span><br><span class=""> </span><span class=""></Script></span>
<p class=""><span class=""></span></p>
<p class=""><span class=""></span></p>
<p class=""><span class=""></span></p>
<p class=""><span class=""></span></p>
<p class=""><span class=""></span></p>
<p class=""><span class=""></span></p>
<p class=""><span class=""></span></p>
<p class=""><span class=""> </span><span class=""></</span><span class="">resolver</span><span class="">:</span><span class="">AttributeDefinition></span></p></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 1, 2016 at 7:20 PM, Mr. Christopher Bland <span dir="ltr"><<a href="mailto:chris@fdu.edu" target="_blank">chris@fdu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word">
<div>Hi David,</div>
<div><br>
</div>
<div>Your solution sounds like the best option during the migration since we are starting to create AD only users. If you are willing to provide a sample attribute definition I would greatly appreciate it as well as any who looks at this tread in
the future.</div>
<div><br>
</div>
<div>-Chris</div><div><div class="h5">
<div><br>
</div>
<br>
<div>
<blockquote type="cite">
<div>On Mar 31, 2016, at 1:22 PM, IAM David Bantz <<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>> wrote:</div>
<br>
<div>
<div dir="ltr">This isn't too hard to build in a scripted attribute - we do exactly this with sources MS AD and Oracle LDAP sources: map attribute to the preferred source attribute if it exists, otherwise to the secondary source. (happy to provide
our example if requested)
<div><br>
</div>
<div>David Bantz</div>
<div>UA OIT IAM<br>
<div>
<div>
<div><br>
</div>
<div> </div>
<div><span></span><br>
</div>
<div><span></span><br>
</div>
<div><span></span><br>
</div>
<div><span></span><br>
</div>
</div>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Mar 31, 2016 at 5:50 AM, Cantor, Scott <span dir="ltr">
<<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span>> My organization is in the process of moving a new Directory Server. As such I<br>
> have configure DataConnector for each. What I have started to notice that<br>
> for a subset of users that have had information updated in the new system I<br>
> am getting multivalued attributes for things like surname. ex Directory 1 has<br>
> Surname=Smith, Directory 2 has Surname=Smith Sr. This would result in the<br>
> attribute Surname=Smith;Smith Sr.<br>
><br>
> Is there any way to say Directory 1 is authoritative for Surname since I cannot<br>
> prevent both Directories from responding?<br>
<br>
</span>Not without your own logic to do it. Generally you should have one directory be a failover for the other, not access both.<br>
<span><font color="#888888"><br>
-- Scott<br>
</font></span>
<div>
<div><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div></div></div>
</blockquote></div><br></div>