<div dir="ltr">Posting here offered the 'aha' moment -- the attribute definition was filtering on attribute 'cn' and not 'entryDn'.<div><br></div><div>Solved now........</div><div><br></div><div>Thanks.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jul 11, 2017 at 3:34 PM, ls Lidz <span dir="ltr"><<a href="mailto:lslidzgeneve@gmail.com" target="_blank">lslidzgeneve@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Been triaging on this for a while -- posting here on if someone can spot if missed anything.<div><br></div><div>I'm trying to obtain all the uniqueMember of groups a user has.</div><div><br></div><div>If using 'cn' as the returned attributes all fine; but if using entryDN, nada is returned via SAML but the logs show that it has successfully read from LDAP.</div><div><br></div><div>idPv3.3.0</div><div><br></div><div>The attribute definition, data connector, and logs are below.</div><div><br></div><div>Could anyone peruse on what could have been missed...thanks.</div><div><br></div><div><br></div><div>ATTRIBUTE DEFINITION</div><div><div><!-- uniqueMember --></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <resolver:AttributeDefinition id="exampleEduUniqueMember" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.<wbr>0:resolver:ad" sourceAttributeID="cn"></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <resolver:Dependency ref="exampleLDAPUNIQUEMEMBER" /></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <resolver:AttributeEncoder xsi:type="SAML2String" </div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>xmlns="urn:mace:shibboleth:2.<wbr>0:attribute:encoder" </div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>name="urn:mace:dir:attribute-<wbr>def:exampleEduUniqueMember" </div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>friendlyName="<wbr>exampleEduUniqueMember"/></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> </resolver:<wbr>AttributeDefinition></div><div><br></div><div>DATA CONNECTOR</div><div><br></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <resolver:DataConnector id="exampleLDAPUNIQUEMEMBER" xsi:type="dc:LDAPDirectory"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> ldapURL="%{idp.attribute.<wbr>resolver.LDAP.ldapURL}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> baseDN="%{example.attribute.<wbr>resolver.LDAP.uniqueMember.<wbr>baseDN}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> principal="%{idp.attribute.<wbr>resolver.LDAP.bindDN}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> principalCredential="%{idp.<wbr>attribute.resolver.LDAP.<wbr>bindDNCredential}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> useStartTLS="%{idp.attribute.<wbr>resolver.LDAP.useStartTLS}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> connectTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>connectTimeout}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> responseTimeout="%{idp.<wbr>attribute.resolver.LDAP.<wbr>responseTimeout}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> maxResultSize="0"></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <resolver:<wbr>FailoverDataConnector ref="<wbr>ACCESSexampleLDAPUNIQUEMEMBER-<wbr>staticfailoverconnector" /></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <dc:FilterTemplate></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <![CDATA[</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> (&(objectClass=<wbr>groupOfUniqueNames)(<wbr>uniqueMember=uid=$<wbr>requestContext.principalName,<wbr>ou=PEOPLE,ou=IDM,dc=stg,dc=<wbr>iam,dc=example,dc=edu))</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> ]]></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> </dc:FilterTemplate></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <dc:ReturnAttributes>entryDN<<wbr>/dc:ReturnAttributes></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> <dc:ConnectionPool</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> minPoolSize="%{idp.pool.LDAP.<wbr>minSize}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> maxPoolSize="%{idp.pool.LDAP.<wbr>maxSize}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> blockWaitTime="%{idp.pool.<wbr>LDAP.blockWaitTime}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> validatePeriodiedully="%{idp.<wbr>pool.LDAP.<wbr>validatePeriodiedully}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> validateTimerPeriod="%{idp.<wbr>pool.LDAP.validatePeriod}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> expirationTime="%{idp.pool.<wbr>LDAP.idleTime}"</div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> failFastInitialize="%{idp.<wbr>pool.LDAP.failFastInitialize}" /></div><div><span class="m_7647559836858717gmail-Apple-tab-span" style="white-space:pre-wrap"> </span> </resolver:DataConnector></div></div><div><br></div><div><br></div><div>IDP v3.3.0 LOGS:</div><div><br></div><div><div>2017-07-11 15:16:58,081 - DEBUG [net.shibboleth.iamp.<wbr>attribute.resolver.<wbr>AbstractDataConnector:143] - [<wbr>772ADEE61FDB2C52BBE06B43C5184A<wbr>A7] - [IP Address] - Data Connector 'exampleLDAPUNIQUEMEMBER': Attribute 'entryDN': Values '[StringAttributeValue{value=<wbr>cn=acl2,ou=grou</div><div>ps,ou=vmware-vcentre,ou=<wbr>services,dc=stg,dc=iam,dc=<wbr>example,dc=edu}, StringAttributeValue{value=cn=<wbr>wireless,ou=groups,ou=radius,<wbr>ou=services,dc=stg,dc=iam,dc=<wbr>example,dc=edu}, StringAttributeValue{value=cn=<wbr>orchard,ou=groups,ou=ciscoise,<wbr>ou=services,dc=stg,dc=iam,dc=<wbr>example,dc=edu}, StringAttr</div><div>ibuteValue{value=cn=ccee-<wbr>rededup-users,ou=groups,ou=<wbr>fomccee,ou=services,dc=stg,dc=<wbr>iam,dc=example,dc=edu}, StringAttributeValue{value=cn=<wbr>acl,ou=groups,ou=vmware-<wbr>vcentre,ou=services,dc=stg,dc=<wbr>iam,dc=example,dc=edu}, StringAttributeValue{value=cn=<wbr>vpn,ou=groups,ou=radius,ou=<wbr>services,dc=</div><div>stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=<wbr>directory administrators,dc=stg,dc=iam,<wbr>dc=example,dc=edu}, StringAttributeValue{value=cn=<wbr>stf_itam,ou=itam,ou=vpac,ou=<wbr>example,ou=employee,dc=stg,dc=<wbr>iam,dc=example,dc=edu}, StringAttributeValue{value=cn=<wbr>uit.adm,ou=groups,ou=uit,ou=se</div><div>rvices,dc=stg,dc=iam,dc=<wbr>example,dc=edu}]'</div><div><br></div><div>2017-07-11 15:16:58,082 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:385] - [<wbr>772ADEE61FDB2C52BBE06B43C5184A<wbr>A7] - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Data connector 'exampleLDAPUNIQUEMEMBER' resolved the follo</div><div>wing attributes: [entryDN]</div><div>2017-07-11 15:16:58,082 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:427] - [<wbr>772ADEE61FDB2C52BBE06B43C5184A<wbr>A7] - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'exampleEduUniqueMember'</div><div>2017-07-11 15:16:58,083 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.<wbr>AbstractAttributeDefinition:<wbr>245] - [<wbr>772ADEE61FDB2C52BBE06B43C5184A<wbr>A7] - [IP Address] - Attribute Definition 'exampleEduUniqueMember': produced an attribute with no values</div><div>2017-07-11 15:16:58,083 - DEBUG [net.shibboleth.idp.attribute.<wbr>resolver.impl.<wbr>AttributeResolverImpl:308] - [<wbr>772ADEE61FDB2C52BBE06B43C5184A<wbr>A7] - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'exampleEduUniqueMember' produced an attribu</div><div>te with 0 values</div></div></div>
</blockquote></div><br></div>