<div dir="ltr">Been triaging on this for a while -- posting here on if someone can spot if missed anything.<div><br></div><div>I'm trying to obtain all the uniqueMember of groups a user has.</div><div><br></div><div>If using 'cn' as the returned attributes all fine; but if using entryDN, nada is returned via SAML but the logs show that it has successfully read from LDAP.</div><div><br></div><div>idPv3.3.0</div><div><br></div><div>The attribute definition, data connector, and logs are below.</div><div><br></div><div>Could anyone peruse on what could have been missed...thanks.</div><div><br></div><div><br></div><div>ATTRIBUTE DEFINITION</div><div><div><!-- uniqueMember --></div><div><span class="gmail-Apple-tab-span" style="white-space:pre"> </span>   <resolver:AttributeDefinition id="exampleEduUniqueMember" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad" sourceAttributeID="cn"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">      </span>        <resolver:Dependency ref="exampleLDAPUNIQUEMEMBER" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">      </span>        <resolver:AttributeEncoder xsi:type="SAML2String" </div><div><span class="gmail-Apple-tab-span" style="white-space:pre">   </span>        <span class="gmail-Apple-tab-span" style="white-space:pre">                                  </span>xmlns="urn:mace:shibboleth:2.0:attribute:encoder" </div><div><span class="gmail-Apple-tab-span" style="white-space:pre">  </span>        <span class="gmail-Apple-tab-span" style="white-space:pre">                                  </span>name="urn:mace:dir:attribute-def:exampleEduUniqueMember"  </div><div><span class="gmail-Apple-tab-span" style="white-space:pre">  </span>        <span class="gmail-Apple-tab-span" style="white-space:pre">                                  </span>friendlyName="exampleEduUniqueMember"/></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">   </span>   </resolver:AttributeDefinition></div><div><br></div><div>DATA CONNECTOR</div><div><br></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">               </span>  <resolver:DataConnector id="exampleLDAPUNIQUEMEMBER" xsi:type="dc:LDAPDirectory"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">             </span>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">         </span>        baseDN="%{example.attribute.resolver.LDAP.uniqueMember.baseDN}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">          </span>        principal="%{idp.attribute.resolver.LDAP.bindDN}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                </span>        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">            </span>        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">         </span>        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">           </span>        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">         </span>        maxResultSize="0"></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">            </span>        <resolver:FailoverDataConnector ref="ACCESSexampleLDAPUNIQUEMEMBER-staticfailoverconnector" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">             </span>        <dc:FilterTemplate></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">          </span>            <![CDATA[</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">         </span>                (&(objectClass=groupOfUniqueNames)(uniqueMember=uid=$requestContext.principalName,ou=PEOPLE,ou=IDM,dc=stg,dc=iam,dc=example,dc=edu))</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">               </span>            ]]></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">               </span>        </dc:FilterTemplate></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">         </span>        <dc:ReturnAttributes>entryDN</dc:ReturnAttributes></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">                     </span>    <dc:ConnectionPool</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">            </span>            minPoolSize="%{idp.pool.LDAP.minSize}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">             </span>            maxPoolSize="%{idp.pool.LDAP.maxSize}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">             </span>            blockWaitTime="%{idp.pool.LDAP.blockWaitTime}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">             </span>            validatePeriodiedully="%{idp.pool.LDAP.validatePeriodiedully}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">             </span>            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">              </span>            expirationTime="%{idp.pool.LDAP.idleTime}"</div><div><span class="gmail-Apple-tab-span" style="white-space:pre">         </span>            failFastInitialize="%{idp.pool.LDAP.failFastInitialize}" /></div><div><span class="gmail-Apple-tab-span" style="white-space:pre">             </span>  </resolver:DataConnector></div></div><div><br></div><div><br></div><div>IDP v3.3.0 LOGS:</div><div><br></div><div><div>2017-07-11 15:16:58,081 - DEBUG [net.shibboleth.iamp.attribute.resolver.AbstractDataConnector:143] - [772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Data Connector 'exampleLDAPUNIQUEMEMBER': Attribute 'entryDN': Values '[StringAttributeValue{value=cn=acl2,ou=grou</div><div>ps,ou=vmware-vcentre,ou=services,dc=stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=wireless,ou=groups,ou=radius,ou=services,dc=stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=orchard,ou=groups,ou=ciscoise,ou=services,dc=stg,dc=iam,dc=example,dc=edu}, StringAttr</div><div>ibuteValue{value=cn=ccee-rededup-users,ou=groups,ou=fomccee,ou=services,dc=stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=acl,ou=groups,ou=vmware-vcentre,ou=services,dc=stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=vpn,ou=groups,ou=radius,ou=services,dc=</div><div>stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=directory administrators,dc=stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=stf_itam,ou=itam,ou=vpac,ou=example,ou=employee,dc=stg,dc=iam,dc=example,dc=edu}, StringAttributeValue{value=cn=uit.adm,ou=groups,ou=uit,ou=se</div><div>rvices,dc=stg,dc=iam,dc=example,dc=edu}]'</div><div><br></div><div>2017-07-11 15:16:58,082 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:385] - [772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Data connector 'exampleLDAPUNIQUEMEMBER' resolved the follo</div><div>wing attributes: [entryDN]</div><div>2017-07-11 15:16:58,082 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:427] - [772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving dependencies for 'exampleEduUniqueMember'</div><div>2017-07-11 15:16:58,083 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:245] - [772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Definition 'exampleEduUniqueMember': produced an attribute with no values</div><div>2017-07-11 15:16:58,083 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:308] - [772ADEE61FDB2C52BBE06B43C5184AA7] - [IP Address] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute definition 'exampleEduUniqueMember' produced an attribu</div><div>te with 0 values</div></div></div>