<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I misunderstood Scott the first time he said I was barking up the
wrong tree. My apologies. <br>
<br>
In ldap.properties I was modifying
idp.attribute.resolver.LDAP.searchFilter which obviously was way
off.... <br>
<br>
I set idp.authn.LDAP.userFilter to
(&(mail=$requestContext.principalName)(memberOf=CN=MyGroup,CN=Users,DC=school,DC=net))
and it works great. <br>
<br>
Thanks for all your help shib users :)<br>
<br>
<div class="moz-cite-prefix">On 05/03/2017 05:15 PM, IAM David Bantz
wrote:<br>
</div>
<blockquote
cite="mid:CAJ9XvwE6PZUNv2MqJb1x_15JowOdS+es5pUY=MDocSHBoWJLxg@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<div dir="ltr">DataConnectors are used in attribute-resolver.xml
and as Scott has stated 2 or 3 times, attribute resolution
occurs AFTER user authentication and cannot retroactively fail
the (previously successful) user authentication.
<div><br>
</div>
<div>Edit the ldap filter used in the authentication phase. I
provided an example filter in the case you're using ldap
authentication in jaas.config:</div>
<div><span style="font-size:12.8px">userFilter="(&(</span><span
style="font-size:12.8px;font-variant-ligatures:no-common-ligatures;color:rgb(0,0,0);font-family:menlo">sAMAccountName</span><span
style="font-size:12.8px">=</span><wbr
style="font-size:12.8px"><span style="font-size:12.8px">{user})(memberOf=CN=MyGroup,CN</span><wbr
style="font-size:12.8px"><span style="font-size:12.8px">=Users,DC=umass,DC=net)"</span><br>
</div>
<div><span style="font-size:12.8px"><br>
</span></div>
<div><span style="font-size:12.8px">David Bantz</span></div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Wed, May 3, 2017 at 12:54 PM,
Cantor, Scott <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"><span
class="">On 5/3/17, 4:30 PM, "users on behalf of Daniel
McDonald" <<a moz-do-not-send="true"
href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>
on behalf of <a moz-do-not-send="true"
href="mailto:daniel.mcdonald@umb.edu">daniel.mcdonald@umb.edu</a>>
wrote:<br>
<br>
> Right now I have this as my CDATA section within my
DataConnector which successfully matches on the mail
attribute.<br>
<br>
</span>That's not about authentication, so you're still
going about this wrong.<br>
<br>
> This is successfully authenticating:<br>
<br>
No, it's successfully getting attributes (or not).<br>
<span class=""><br>
> I tried this next line but it didnt seem to work,
users not in the group are able to login:<br>
<br>
</span>Because that has nothing to do with authentication,
that's happening afterwards. It presupposes authentication
happened (excepting attribute queries, but leave that
aside).<br>
<div class="HOEnZb">
<div class="h5"><br>
-- Scott<br>
<br>
<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a
moz-do-not-send="true"
href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div>
</div>
</blockquote>
</div>
<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>