<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:11pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<div id="divtagdefaultwrapper" style="font-size: 11pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<p>On the topic of the question, since you're using AD, <span style="font-size: 11pt;">I'd see if you could use the tokenGroups</span><span style="font-size: 11pt;"> attribute [1] and then translate the SIDs it contains into usable group names.</span></p>
<p><br>
</p>
<p><span style="font-size: 11pt;">Michael</span><br>
</p>
<p><br>
</p>
<p>[1] <a href="https://msdn.microsoft.com/en-us/library/ms680275(v=vs.85).aspx" class="OWAAutoLink" id="LPlnk765107" previewremoved="true">https://msdn.microsoft.com/en-us/library/ms680275(v=vs.85).aspx</a></p>
<p><br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Domingues, Michael D<br>
<b>Sent:</b> Tuesday, July 25, 2017 10:21:41 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: AD nested groups</font>
<div> </div>
</div>
<div><style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper" style="font-size: 11pt; color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;" dir="ltr">
<p>Not directly related to this question, but worth noting. Unless I'm horribly misunderstanding things (and my testing leads me to believe that this is true), I don't think that the version of Ldaptive bundled with Shibboleth (as of 3.3.1) respects java.naming.referral
= "follow".</p>
<p><br>
</p>
<p>Referral chasing support was only introduced in Ldaptive 1.1.0 [1], and Shibboleth (as of 3.3.1) ships with 1.0.9.</p>
<p><br>
</p>
<p>Michael</p>
<p><br>
</p>
<p>[1] <a href="http://www.ldaptive.org/changelog.html" id="LPlnk804562" previewremoved="true" style="color: rgb(5, 99, 193); text-decoration: underline;">http://www.ldaptive.org/changelog.html</a></p>
<p><br>
</p>
<p><br>
</p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Hong Ye <hy93@cornell.edu><br>
<b>Sent:</b> Tuesday, July 25, 2017 10:00:17 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> AD nested groups</font>
<div> </div>
</div>
<div>
<div style="page: WordSection1;">
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt">Hi,<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt">Does anyone know how to get all the AD group membership including nested groups for a user in AttributeResolver? I tried the solution below, but it’s very slow. Is there any other solution?<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"><!-- get the user's DN from the main LDAP connector (myLDAP) for searching the groups the user is in --><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <resolver:AttributeDefinition id="distinguishedName" xsi:type="ad:Simple"<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> sourceAttributeID="distinguishedname"><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <resolver:Dependency ref="psdldap" /><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <!-- no encoder needed, use your existing ldap connector as dependency --><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> </resolver:AttributeDefinition><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <!-- search <b>for</b> all groups the user is recursively in - and flatten the distinguishedName(s) of all the groups into a single multivalued attribute (copy from existing connector, note searchTimeLimit) --><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <resolver:DataConnector id="groupLDAP" xsi:type="dc:LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" ldapURL="ldap://ldap-server:389" baseDN="your base dn" principal="Admin User CN" principalCredential="Admin Pass"
useStartTLS="false" maxResultSize="1000" mergeResults="true" searchTimeLimit="0"><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <resolver:Dependency ref="distinguishedName" /><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <dc:FilterTemplate><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <![CDATA[<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> (member:1.2.840.113556.1.4.1941:=${distinguishedName.get(0)})<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> ]]><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> </dc:FilterTemplate><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <dc:ReturnAttributes>distinguishedName</dc:ReturnAttributes><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <dc:LDAPProperty name="java.naming.referral" value="follow"/><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> </resolver:DataConnector><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <resolver:AttributeDefinition id="memberOf" xsi:type="ad:Simple"<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> sourceAttributeID="distinguishedName"><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <resolver:Dependency ref="groupLDAP" /><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <!-- no encoder needed --><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> </resolver:AttributeDefinition><o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt">Hong<o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"> <o:p></o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: Calibri, sans-serif;">
<span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>