<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Consolas, Courier, monospace; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
This is perfect. Thank you!<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Brent Putman <putmanb@georgetown.edu><br>
<b>Sent:</b> Friday, August 7, 2020 1:13 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net>; Zach Hanson-Hart <zach@temple.edu><br>
<b>Subject:</b> [External] Re: LDAPConnector aggregate matching DNs?</font>
<div> </div>
</div>
<div>
<p><br>
</p>
<div class="x_moz-cite-prefix">On 8/7/20 12:04 PM, Zach Hanson-Hart wrote:<br>
</div>
<blockquote type="cite"><style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div style="font-family:Consolas,Courier,monospace; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<div style="color:black; font-size:12pt; font-family:Consolas,Courier,monospace,serif,EmojiFont; background-color:white">
Hello list!</div>
<div style="color:black; font-size:12pt; font-family:Consolas,Courier,monospace,serif,EmojiFont; background-color:white">
<br>
</div>
<div style="color:black; font-size:12pt; font-family:Consolas,Courier,monospace,serif,EmojiFont; background-color:white">
I have a use case to grab the DNs of all of the matching entries on an LDAPConnector. These are groups with membership containing the principalName from the requestContext, but the users do not have entries in the directory. It is an OpenLDAP directory.
I've tried various things for ReturnAttributes, like 1.1, dn, distinguishedName just as a shot in the dark. <br>
</div>
<div style="color:black; font-size:12pt; font-family:Consolas,Courier,monospace,serif,EmojiFont; background-color:white">
<br>
</div>
<div style="color:black; font-size:12pt; font-family:Consolas,Courier,monospace,serif,EmojiFont; background-color:white">
The entries have objectClass organizationalUnit and eduMember. I have no problem getting the OU of the entries as an IDP attribute and releasing it. But I can't get DNs
<span>🙁</span><br>
</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>Since it's OpenLDAP you can probably take advantage of operational attributes. Specify "+" in ReturnAttributes (in addition to whatever other attribs you want), and you should see it return entryDN as a regular attribute of each returned object. See:</p>
<p><br>
</p>
<p><a class="x_moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP4/ReturnAttributes">https://wiki.shibboleth.net/confluence/display/IDP4/ReturnAttributes</a><br>
</p>
</div>
</body>
</html>