<div dir="ltr">AD admins can put other attributes (employeeID or others) into the general catalog. <div><br></div><div>see <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues">https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues</a> </div><div><br></div><div>David Bantz</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jan 24, 2017 at 5:13 AM, Edward Patri <span dir="ltr"><<a href="mailto:Edward.Patri@csi.cuny.edu" target="_blank">Edward.Patri@csi.cuny.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Douglas,<br>
<br>
Thank you for all your assistance on this. I was able to resolve the issue.<br>
<br>
It seems that the shibboleth Auth was working over port 636 but the resolver was defined to use port 3269 instead of 636. Which explains why I couldn’t resolve the employeeID attribute since it is not part of the global catalog. Once I changed the port everything started working the way it should.<br>
<span class="im HOEnZb"><br>
<br>
Edward Patri<br>
Networking Services<br>
CUNY - College of Staten Island<br>
2800 Victory Blvd 2A-300<br>
Staten Island, NY 10314<br>
Office: <a href="tel:%28718%29%20982-2705" value="+17189822705">(718) 982-2705</a><br>
<a href="mailto:Edward.Patri@csi.cuny.edu">Edward.Patri@csi.cuny.edu</a><br>
<br>
</span><span class="im HOEnZb">-----Original Message-----<br>
From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a>] On Behalf Of Douglas E Engert<br>
</span><div class="HOEnZb"><div class="h5">Sent: Tuesday, January 24, 2017 8:26 AM<br>
To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
Subject: Re: Need assistance releasing Active Directory "employeeID" attribute<br>
<br>
<br>
<br>
On 1/23/2017 9:55 PM, Edward Patri wrote:<br>
> Hi Douglas,<br>
><br>
> You are correct. I am trying to release the AD attribute employeeID. Do you have any suggestions on how I can accomplish this?<br>
<br>
First of all, does the IDP ldap query return the attribute? Look at the logs.<br>
look at the logs to see what is sent to the SP. Does it send other attributes, but not the employeeID.<br>
<br>
If not, rather then using idp.attribute.resolver.LDAP.<wbr>returnAttributes= * list out all the attributes you need.<br>
<br>
If it is returned, try using:<br>
<resolver:AttributeEncoder xsi:type="enc:SAML2String" nameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>unspecified" name="employeeID" /> i.e. don't use the OID, as the SP may not understand it.<br>
<br>
google for idp.attribute.resolver.LDAP.<wbr>returnAttributes<br>
<br>
What is in the myLDAP dataconnector? Is it substituting the idp.attribute.resolver.LDAP.<wbr>returnAttributes?<br>
<br>
(This is off the top of my head. I am retired, but in 2014 I did use the employeeID from AD 2008.)<br>
<br>
<br>
<br>
><br>
> -----Original Message-----<br>
> From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a>] On Behalf Of Douglas<br>
> E Engert<br>
> Sent: Monday, January 23, 2017 5:51 PM<br>
> To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a><br>
> Subject: Re: Need assistance releasing Active Directory "employeeID"<br>
> attribute<br>
><br>
><br>
><br>
> On 1/23/2017 4:09 PM, Matt Brennan wrote:<br>
>> Actually, I believe the attribute identifier you are using is<br>
>> incorrect. I believe, for SAML2, it should be<br>
>> "urn:oid:2.16.840.1.113730.3.<wbr>1.3". For SAML1, it should be "urn:mace:dir:attribute-def:<wbr>employeeNumber". Spec is available at "<a href="http://www.faqs.org/rfcs/rfc2798.html" rel="noreferrer" target="_blank">http://www.faqs.org/rfcs/<wbr>rfc2798.html</a>". But that shouldn't effect what attributes you are seeing released in a test script; it would just affect the ability of the SP to use the attributes.<br>
><br>
><br>
> AD has employeeID which is different from employeeNumber<br>
><br>
> <a href="https://msdn.microsoft.com/en-us/library/ms675662(v=vs.85).aspx" rel="noreferrer" target="_blank">https://msdn.microsoft.com/en-<wbr>us/library/ms675662(v=vs.85).<wbr>aspx</a><br>
><br>
>><br>
>> Are you seeing any related log messages, either when loading the configuration or when sending the assertion?<br>
>><br>
>> Anything at all in the logs related to the attribute?<br>
>><br>
>> -Matt<br>
>><br>
>> On Mon, Jan 23, 2017 at 4:40 PM, Edward Patri <<a href="mailto:Edward.Patri@csi.cuny.edu">Edward.Patri@csi.cuny.edu</a> <mailto:<a href="mailto:Edward.Patri@csi.cuny.edu">Edward.Patri@csi.cuny.<wbr>edu</a>>> wrote:<br>
>><br>
>> Hi Doug,<br>
>><br>
>> I am connection to our Domain Controller over port 636 not over global catalog 3268. I verified using softerra ldap broswer that the shibboleth account can read the attribute employeeID. Also I<br>
>> verified that employeeID is populated.<br>
>><br>
>> I am currently running IDP version 3.2.1.0 not sure if it makes a difference.<br>
>><br>
>><br>
>><br>
>> -----Original Message-----<br>
>> From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a> <mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a>>] On Behalf Of Douglas E Engert<br>
>> Sent: Monday, January 23, 2017 4:30 PM<br>
>> To: <a href="mailto:users@shibboleth.net">users@shibboleth.net</a> <mailto:<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
>> Subject: Re: Need assistance releasing Active Directory<br>
>> "employeeID" attribute<br>
>><br>
>><br>
>><br>
>> On 1/23/2017 2:14 PM, Edward Patri wrote:<br>
>> > Hi Scott,<br>
>> ><br>
>> > I have configured our ldap.properties to return all attributes using the following command.<br>
>> ><br>
>> > idp.attribute.resolver.LDAP.<wbr>returnAttributes= *<br>
>><br>
>> Note employeeID is not the global catalog.<br>
>><br>
>> It may also not be readable by the user.<br>
>><br>
>> employeeID needs to be entered by your AD admins, are you sure the accounts have this attribute?<br>
>><br>
>> AD has hundreds of attributes, I found it was best to list only the attributes you want.<br>
>><br>
>> Also found testing ldap queries of AD using openldap and ADSI edit to be very helpful to see what is really returned and if the accounts have the attribute set.<br>
>><br>
>> With IDP 2 I used to create a username for only one specific SP and used:<br>
>> <resolver:AttributeEncoder xsi:type="enc:SAML2String"<br>
>> nameFormat="urn:oasis:names:<wbr>tc:SAML:2.0:attrname-format:<wbr>unspecified"<br>
>> name="username" /><br>
>><br>
>> ><br>
>> > I have removed the SAML1 string line and as for the SAML 2.0 isnt that line correct?<br>
>> ><br>
>> > I am using the aacli.bat script to test which attributes I am releasing to a certain SP and the employeeID attribute is not being released although it is configured to be released in the<br>
>> attribute-filter.xml file.<br>
>> ><br>
>> > I am still getting used to shibboleth and any assistance would be greatly appreciated.<br>
>> ><br>
>> > <br>
>> ><br>
>> > -----Original Message-----<br>
>> > From: users [mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a> <mailto:<a href="mailto:users-bounces@shibboleth.net">users-bounces@<wbr>shibboleth.net</a>>] On Behalf Of Cantor, Scott<br>
>> > Sent: Monday, January 23, 2017 3:06 PM<br>
>> > To: Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a> <mailto:<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>>><br>
>> > Cc: Stanley Tse <<a href="mailto:Stanley.Tse@csi.cuny.edu">Stanley.Tse@csi.cuny.edu</a> <mailto:<a href="mailto:Stanley.Tse@csi.cuny.edu">Stanley.Tse@csi.cuny.<wbr>edu</a>>><br>
>> > Subject: RE: Need assistance releasing Active Directory "employeeID" attribute<br>
>> ><br>
>> >> <resolver:AttributeEncoder xsi:type="enc:SAML1String"<br>
>> >> name="urn:mace:dir:attribute-<wbr>def:employeeID" encodeType="false" /><br>
>> ><br>
>> > You cannot make up names yourself like that, you don't own that namespace. And you don't need SAML 1.1 support, so don't worry about it. Its name in any case would be the same as in SAML 2.0.<br>
>> ><br>
>> > As for the rest, you need to actually describe a specific problem to get help. What did the log tell you? You certainly didn't just change that alone? You can't manufacture an attribute out of<br>
>> thin air. If you tell it to get it from LDAP, then your LDAP connector has to retrieve it. Some people do a search for all attributes but many don't.<br>
>> ><br>
>> > -- Scott<br>
>> ><br>
>><br>
>> --<br>
>><br>
>> Douglas E. Engert <<a href="mailto:DEEngert@gmail.com">DEEngert@gmail.com</a><br>
>> <mailto:<a href="mailto:DEEngert@gmail.com">DEEngert@gmail.com</a>>><br>
>><br>
>> --<br>
>> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a> <mailto:<a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@<wbr>shibboleth.net</a>><br>
>> --<br>
>> To unsubscribe from this list send an email to<br>
>> <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
>> <mailto:<a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@<wbr>shibboleth.net</a>><br>
>><br>
>><br>
>><br>
>><br>
><br>
<br>
--<br>
<br>
Douglas E. Engert <<a href="mailto:DEEngert@gmail.com">DEEngert@gmail.com</a>><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a></div></div></blockquote></div><br></div>