<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mv="http://macVmlSchemaUri" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Title" content="">
<meta name="Keywords" content="">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.msoIns
{mso-style-type:export-only;
mso-style-name:"";
text-decoration:underline;
color:teal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Michael,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks for your reply. I don’t know how to write a scrip to get the group names for each SID in attribute resolver. Is there an example in WIKI?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hong<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of "Domingues, Michael D" <michael-domingues@uiowa.edu><br>
<b>Reply-To: </b>Shib Users <users@shibboleth.net><br>
<b>Date: </b>Tuesday, July 25, 2017 at 11:44 AM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: AD nested groups<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div id="divtagdefaultwrapper">
<div id="divtagdefaultwrapper">
<p><span style="color:black">On the topic of the question, since you're using AD, I'd see if you could use the tokenGroups attribute [1] and then translate the SIDs it contains into usable group names.<o:p></o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
<p><span style="color:black">Michael<o:p></o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
<p><span style="color:black">[1] <a href="https://msdn.microsoft.com/en-us/library/ms680275(v=vs.85).aspx" id="LPlnk765107">https://msdn.microsoft.com/en-us/library/ms680275(v=vs.85).aspx</a><o:p></o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="color:black">
<hr size="2" width="98%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Domingues, Michael D<br>
<b>Sent:</b> Tuesday, July 25, 2017 10:21:41 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: AD nested groups <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div id="divtagdefaultwrapper">
<p><span style="color:black">Not directly related to this question, but worth noting. Unless I'm horribly misunderstanding things (and my testing leads me to believe that this is true), I don't think that the version of Ldaptive bundled with Shibboleth (as
of 3.3.1) respects java.naming.referral = "follow".<o:p></o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
<p><span style="color:black">Referral chasing support was only introduced in Ldaptive 1.1.0 [1], and Shibboleth (as of 3.3.1) ships with 1.0.9.<o:p></o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
<p><span style="color:black">Michael<o:p></o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
<p><span style="color:black">[1] <a href="http://www.ldaptive.org/changelog.html" id="LPlnk804562"><span style="color:#0563C1">http://www.ldaptive.org/changelog.html</span></a><o:p></o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
<p><span style="color:black"><o:p> </o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="color:black">
<hr size="2" width="98%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> users <users-bounces@shibboleth.net> on behalf of Hong Ye <hy93@cornell.edu><br>
<b>Sent:</b> Tuesday, July 25, 2017 10:00:17 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> AD nested groups <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:black"> <o:p></o:p></span></p>
</div>
</div>
<div>
<p><span style="color:black">Hi,</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black">Does anyone know how to get all the AD group membership including nested groups for a user in AttributeResolver? I tried the solution below, but it’s very slow. Is there any other solution?</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"><!-- get the user's DN from the main LDAP connector (myLDAP) for searching the groups the user is in --></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <resolver:AttributeDefinition id="distinguishedName" xsi:type="ad:Simple"</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> sourceAttributeID="distinguishedname"></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <resolver:Dependency ref="psdldap" /></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <!-- no encoder needed, use your existing ldap connector as dependency --></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </resolver:AttributeDefinition></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <!-- search <b>for</b> all groups the user is recursively in - and flatten the distinguishedName(s) of all the groups into a single multivalued attribute (copy from existing connector, note searchTimeLimit) --></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <resolver:DataConnector id="groupLDAP" xsi:type="dc:LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" ldapURL="ldap://ldap-server:389" baseDN="your base dn" principal="Admin User CN" principalCredential="Admin Pass"
useStartTLS="false" maxResultSize="1000" mergeResults="true" searchTimeLimit="0"></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <resolver:Dependency ref="distinguishedName" /></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <dc:FilterTemplate></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <![CDATA[</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> (member:1.2.840.113556.1.4.1941:=${distinguishedName.get(0)})</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> ]]></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </dc:FilterTemplate></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <dc:ReturnAttributes>distinguishedName</dc:ReturnAttributes></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <dc:LDAPProperty name="java.naming.referral" value="follow"/></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </resolver:DataConnector></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <resolver:AttributeDefinition id="memberOf" xsi:type="ad:Simple"</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> sourceAttributeID="distinguishedName"></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <resolver:Dependency ref="groupLDAP" /></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> <!-- no encoder needed --></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </resolver:AttributeDefinition></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black">Thanks,</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black">Hong</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p><span style="color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>