<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=iso-8859-15">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><font size="+1">Hi to all,</font></p>
<p><font size="+1">GARR is trying to use a Shibboleth IdP (v3.3.x)
as an Attribute Authority to release specific attributes.</font></p>
<p><font size="+1">For example we desire to release the "isMemberOf"
attribute defined as follow in our attribute-resolver.xml
(studied for our Grouper instance):</font></p>
<div style="color: #000000;background-color: #ffffff;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #000000;"> </span><span style="color: #008000;"><!-- AttributeDefinition for "isMemberOf" attribute --></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><AttributeDefinition</span><span style="color: #000000;"> </span><span style="color: #ff0000;">id</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"isMemberOf"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xsi:type</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"Simple"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">sourceAttributeID</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"isMemberOf"</span><span style="color: #800000;">></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><Dependency</span><span style="color: #000000;"> </span><span style="color: #ff0000;">ref</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"isMemberOfDataConnector"</span><span style="color: #000000;"> </span><span style="color: #800000;">/></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><DisplayName</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xml:lang</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"en"</span><span style="color: #800000;">></span><span style="color: #000000;">Grouper groups</span><span style="color: #800000;"></DisplayName></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><DisplayName</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xml:lang</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"it"</span><span style="color: #800000;">></span><span style="color: #000000;">Gruppi Grouper</span><span style="color: #800000;"></DisplayName></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><DisplayDescription</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xml:lang</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"en"</span><span style="color: #800000;">></span><span style="color: #000000;">List of groups retrieved from Grouper</span><span style="color: #800000;"></DisplayDescription></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><DisplayDescription</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xml:lang</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"it"</span><span style="color: #800000;">></span><span style="color: #000000;">Elenco dei gruppi ottenuti da Grouper</span><span style="color: #800000;"></DisplayDescription></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><AttributeEncoder</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xsi:type</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"SAML2String"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">name</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"urn:oid:1.2.840.113556.1.666.1"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">friendlyName</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"isMemberOf"</span><span style="color: #000000;"> </span><span style="color: #800000;">/></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"></AttributeDefinition></span></div>
<div><span style="color: #000000;"> </span><span style="color: #008000;"><!-- Grouper Database connector --></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><DataConnector</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xsi:type</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"RelationalDatabase"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">id</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"isMemberOfDataConnector"</span><span style="color: #800000;">></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><ApplicationManagedConnection</span><span style="color: #000000;"> </span><span style="color: #ff0000;">jdbcDriver</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"com.mysql.jdbc.Driver"</span></div><div><span style="color: #000000;"> </span><span style="color: #ff0000;">jdbcURL</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"jdbc:mysql://localhost:3306/grouper"</span></div><div><span style="color: #000000;"> </span><span style="color: #ff0000;">jdbcUserName</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"###_USER_DB_###"</span></div><div><span style="color: #000000;"> </span><span style="color: #ff0000;">jdbcPassword</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"###_SECRET_###"</span><span style="color: #000000;"> </span><span style="color: #800000;">/></span></div>
<div><span style="color: #000000;"> </span><span style="color: #800000;"><QueryTemplate></span></div><div><span style="color: #000000;"> </span><span style="color: #0000ff;"><![CDATA[</span></div><div><span style="color: #0000ff;"> SELECT DISTINCT REPLACE(GROUP_NAME, CONCAT('resources:', SUBSTRING_INDEX(SUBSTRING_INDEX('$requestContext.getPeerEntityId()', '//', -1), '/', 1), ':'), '') AS GROUP_NAME</span></div><div><span style="color: #0000ff;"> FROM grouper_memberships_lw_v</span></div><div><span style="color: #0000ff;"> WHERE subject_id LIKE (SELECT subject_id FROM grouper_members WHERE subject_identifier0 = '<b>$requestContext.principalName</b>')</span></div><div><span style="color: #0000ff;"> AND GROUP_NAME LIKE CONCAT('resources:', SUBSTRING_INDEX(SUBSTRING_INDEX('$requestContext.getPeerEntityId()', '//', -1), '/', 1), '%')</span></div><div><span style="color: #0000ff;"> AND list_name = 'members'</span></div><div><span style="color: #0000ff;"> AND GROUP_NAME NOT LIKE '%:service:%'</span></div><div><span style="color: #0000ff;"> ]]></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"></QueryTemplate></span></div>
<div><span style="color: #000000;"> </span><span style="color: #800000;"><Column</span><span style="color: #000000;"> </span><span style="color: #ff0000;">columnName</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"GROUP_NAME"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">attributeID</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"isMemberOf"</span><span style="color: #000000;"> </span><span style="color: #800000;">/></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"></DataConnector></span></div></div>
<p><br>
</p>
<p>We recognize the user throught its <b>eduPersonPrincipalName</b>(<font
color="#3333ff"><b>$requestContext.principalName</b></font>)
that is sent from the SP (where the user is trying the login) to
retrieve additional attributes from our AA. It has been possible
thanks the PrincipalConnector:</p>
<div style="color: #000000;background-color: #ffffff;font-family: 'Droid Sans Mono', 'monospace', monospace, 'Droid Sans Fallback';font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span style="color: #000000;"> </span><span style="color: #008000;"><!-- ========================================== --></span></div><div><span style="color: #000000;"> </span><span style="color: #008000;"><!--Deprecated Principal Connectors --></span></div><div><span style="color: #000000;"> </span><span style="color: #008000;"><!-- ========================================== --></span></div><div><span style="color: #000000;"> </span><span style="color: #800000;"><PrincipalConnector</span><span style="color: #000000;"> </span><span style="color: #ff0000;">xsi:type</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"pc:Direct"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">id</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"saml2Direct"</span><span style="color: #000000;"> </span><span style="color: #ff0000;">nameIDFormat</span><span style="color: #000000;">=</span><span style="color: #0000ff;">"urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified"</span><span style="color: #800000;">/>
</span><span style="color: #800000;"></span></div></div>
<p><br>
</p>
<p>As you see, this PrincipalConnector is DEPRECATED and we know
that now there is a new way to do what we are doing with it: <a
moz-do-not-send="true"
href="https://wiki.shibboleth.net/confluence/display/IDP30/NameIDConsumptionConfiguration">NameIDConsumptionConfiguration</a></p>
<p>Unfortunately, I have no idea how can I translate the deprecated
PrincipalConnector into the new NameIDConsumptionConfiguration and
I need your help to do this and trashing the old stuff.</p>
<p>I hope you can help us to trashing the old and deprecated stuff
and, I hope, it will be useful for other people.<br>
</p>
<p>Thank you all guys!<br>
</p>
<pre class="moz-signature" cols="72">--
Marco Malavolti
Consortium GARR - Servizio IDEM GARR AAI
Via dei Tizii, 6 - I-00185 (ROMA)
CF: 97284570583 - PI:07577141000
Tel.: 02 6448 2507
Skype: marco.mala</pre>
</body>
</html>