<div dir="ltr">Someone's probably going to say I'm doing this wrong, but this is what I have: <div><br></div><div>attribute-resolver.xml:<br><div><br></div><div><AttributeDefinition id="distinguishedName" xsi:type="Simple"><br> <InputDataConnector ref="AD" attributeNames="distinguishedName" /><br> <AttributeEncoder xsi:type="SAML2ScopedString" name="urn:oid:1.3.6.1.4.1.1466.115.121.1.12" friendlyName="distinguishedName" encodeType="false" /><br></AttributeDefinition><br><br><AttributeDefinition id="isMemberOfRecursive" xsi:type="Simple"><br> <InputDataConnector ref="ADGroup" attributeNames="cn" /><br> <AttributeEncoder xsi:type="SAML2String" name="urn:oid:1.3.6.1.4.1.20462.5.1.9" friendlyName="isMemberOf" /><br></AttributeDefinition><br><br><!-- Active Directory --><br><DataConnector id="AD" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"><br> <FilterTemplate><br> <![CDATA[<br> %{idp.attribute.resolver.LDAP.searchFilter}<br> ]]><br> </FilterTemplate><br> <ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</ReturnAttributes><br> <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectGUID" /><br></DataConnector><br><br><!-- AD Group Recursive Resolver --><br><DataConnector id="ADGroup" xsi:type="LDAPDirectory"<br> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br> baseDN="<group base DN>"<br> principal="%{idp.attribute.resolver.LDAP.bindDN}"<br> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"<br> maxResultSize="1000"><br> <InputDataConnector ref="AD" attributeNames="distinguishedName" /><br> <FilterTemplate><br> <![CDATA[<br> (member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))<br> ]]><br> </FilterTemplate><br> <ReturnAttributes>cn</ReturnAttributes><br> <LDAPProperty name="java.naming.referral" value="follow" /><br></DataConnector><br></div><div><br></div><div><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Mar 4, 2020 at 6:13 PM Robert Rust <<a href="mailto:robert.j.rust@uwrf.edu">robert.j.rust@uwrf.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> From: "Bickel, David" <<a href="mailto:jdbickel@iu.edu" target="_blank">jdbickel@iu.edu</a>><br>
To: Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
Subject: Flatten out nested ADS groups with Shibboleth IDP<br>
<br>
Hello fellow shibboleth IDP users,<br>
<br>
<br>
Does the newer IDP 3.4.6+ have a better way to retrieve and flatten nested ADS groups from active directory??? The process documented in this legacy post <a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.1660669.n2.nabble.com%2FAD-nested-groups-td7634561.html&amp;data=02%7C01%7Crobert.j.rust%40uwrf.edu%7Cdd51d4f5af9b46ffafe708d7bf94560f%7Cdbdf23c73f3a4bbeae76d7310a527fd8%7C1%7C0%7C637188516141969970&amp;sdata=6uwgVY7xB9ysUGYwqse0VL2JHVrbrmwyNbV%2BvetNdVE%3D&amp;reserved=0" rel="noreferrer" target="_blank">https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.1660669.n2.nabble.com%2FAD-nested-groups-td7634561.html&amp;data=02%7C01%7Crobert.j.rust%40uwrf.edu%7Cdd51d4f5af9b46ffafe708d7bf94560f%7Cdbdf23c73f3a4bbeae76d7310a527fd8%7C1%7C0%7C637188516141969970&amp;sdata=6uwgVY7xB9ysUGYwqse0VL2JHVrbrmwyNbV%2BvetNdVE%3D&amp;reserved=0</a> uses several depreciated pieces like ?mergeResults?.? I appreciate any guidance on a better way to accomplish this task.<br>
<br>
===============<br>
I would be interested in any ideas for improving nested group lookup behavior as well. I'm not using mergeResults but otherwise my connector looks substantially similar. I'm currently battling issues with group lookups timing out periodically, which I'm sure is LDAP load related, but my Shib servers aren't distributing the load particularly well and I haven't come up with a way to load balance AD comfortably yet in the particular environment where these servers live.<br>
<br>
-Robert <br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>