<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for elaborate explanation. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Yes, the issue indeed was with the query not passing specified attributes<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Below configuration works just fine, and now I see “isMemberOf” attribute, to release all operational attribute you can also use “ +“ as previously noted by Scott.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Scott clarified that “exportAttributes” is not a substitute for “returnAttributes” I have used default file available in 4.0.1 (attribute-resolver-ldap.xml) as a sample which provided only “exportAttributes” leading me to believe that it
serves the same purpose. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Brent Putman noted that there was an issue in my XML for return attributes statement, which is what prevented attributes to be specified in the query.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you for helping me to resolve this issue. This is a wonderful community to be a part of.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<o:p></o:p></p>
<p class="MsoNormal"> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<o:p></o:p></p>
<p class="MsoNormal"> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
<o:p></o:p></p>
<p class="MsoNormal"> principal="%{idp.attribute.resolver.LDAP.bindDN}"<o:p></o:p></p>
<p class="MsoNormal"> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<o:p></o:p></p>
<p class="MsoNormal"> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:false}"<o:p></o:p></p>
<p class="MsoNormal"> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<o:p></o:p></p>
<p class="MsoNormal"> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<o:p></o:p></p>
<p class="MsoNormal"> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"<o:p></o:p></p>
<p class="MsoNormal"> exportAttributes="%{idp.attribute.resolver.LDAP.returnAttributes}"><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <![CDATA[<o:p></o:p></p>
<p class="MsoNormal"> %{idp.attribute.resolver.LDAP.searchFilter}<o:p></o:p></p>
<p class="MsoNormal"> ]]><o:p></o:p></p>
<p class="MsoNormal"> </FilterTemplate><o:p></o:p></p>
<p class="MsoNormal"> <ReturnAttributes>mail displayName sn givenName uid cn isMemberOf createTimestamp</ReturnAttributes>
<o:p></o:p></p>
<p class="MsoNormal"> <ConnectionPool<o:p></o:p></p>
<p class="MsoNormal"> minPoolSize="%{idp.pool.LDAP.minSize:3}"<o:p></o:p></p>
<p class="MsoNormal"> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<o:p></o:p></p>
<p class="MsoNormal"> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<o:p></o:p></p>
<p class="MsoNormal"> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<o:p></o:p></p>
<p class="MsoNormal"> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<o:p></o:p></p>
<p class="MsoNormal"> validateDN="%{idp.pool.LDAP.validateDN:}"<o:p></o:p></p>
<p class="MsoNormal"> validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"<o:p></o:p></p>
<p class="MsoNormal"> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/><o:p></o:p></p>
<p class="MsoNormal"> </DataConnector><o:p></o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas;color:#44546A"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas;color:#44546A"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas;color:#44546A"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt">Moses Feinstein<o:p></o:p></span></b></p>
<p class="MsoNormal"><i><span style="font-size:8.0pt;color:#767171">Sr. Software / IAM Engineer, App Dev Dept<o:p></o:p></span></i></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt">Emaill</span></b><span style="font-size:8.0pt">:
<a href="mailto:moses.feinstein@touro.edu"><span style="color:#0563C1">moses.feinstein@touro.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Donald Lohr<br>
<b>Sent:</b> Tuesday, December 1, 2020 1:36 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Reading groups membership in Shibboleth 4.0.1<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid black 1.5pt;padding:1.0pt 1.0pt 1.0pt 1.0pt;overflow:float:left">
<p class="MsoNormal" style="background:yellow"><strong><span style="font-family:"Calibri",sans-serif;color:red">External Email</span></strong><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If you break apart your log data, here's what I see referring to the following portion of your log:<br>
<br>
<span style="font-family:"Courier New"">[org.ldaptive.SearchOperation:154] - execute response=<br>
</span><br>
You see this:<br>
<br>
<span style="font-family:"Courier New"">[[dn=uid=awong,ou=People,dc=example,dc=org[[uid[awong]], [mail[<a href="mailto:awong@example.org">awong@example.org</a>]], [givenName[Ada]], [displayName[some_display_name]], [cn[Ada D. Wong]], [sn[Wong]], [objectClass[top,
person, organizationalPerson, inetOrgPerson]], [entryDN[uid=awong,ou=People,dc=example,dc=org]], [userPassword[{SSHA512}qbX9IGEjiPQsOdcHhuBNdxMmjhzrrCrxGIODgnFe5UCzo7fDSFV7mwV0KMNF9LaUz3CzxjTTO/HsiOPTNy6SrElwY9IkNUDU]]],<br>
</span><br>
...if you break it down and make it look similar to the results returned from a command-line ldapsearch, you will find:<br>
<br>
<span style="font-family:"Courier New"">dn=uid=awong,ou=People,dc=example,dc=org<br>
uid[awong]<br>
mail[<a href="mailto:awong@example.org">awong@example.org</a>]<br>
givenName[Ada]<br>
displayName[some_display_name]<br>
cn[Ada D. Wong]<br>
sn[Wong]<br>
<b>objectClass</b>[top, person, organizationalPerson, inetOrgPerson]<br>
<b>entryDN</b>[uid=awong,ou=People,dc=example,dc=org]<br>
<b>userPassword</b>[{SSHA512}qbX9IGEjiPQsOdcHhuBNdxMmjhzrrCrxGIODgnFe5UCzo7fDSFV7mwV0KMNF9LaUz3CzxjTTO/HsiOPTNy6SrElwY9IkNUDU]<br>
</span><br>
Based on the attribute list you say you are asking for:<br>
<br>
<o:p></o:p></p>
<pre>mail displayName sn givenName uid cn isMemberOf createTimestamp<o:p></o:p></pre>
<p class="MsoNormal" style="margin-bottom:12.0pt">...your shib/ldap config is ONLY getting back the normal attributes that are available. I say that because, objectClass, entryDN and userPassword are in the returned results and these were not asked for.<br>
<br>
So this tells me your Shib/ldap config is not asking for what you want.<br>
<br>
If you look at another portion of your log, you will see:<br>
<br>
<span style="font-family:"Courier New"">baseDn=ou=People,dc=example,dc=org, searchFilter=[org.ldaptive.SearchFilter@-2000959517::filter=(uid=awong), parameters={}], returnAttributes=[], searchScope=SUBTREE, timeLimit=PT3S, sizeLimit=1,<br>
</span><br>
...if you break it down, you see the following:<br>
<br>
<span style="font-family:"Courier New"">baseDn=ou=People,dc=example,dc=org<br>
filter=(uid=awong)<br>
<b>returnAttributes</b>=[]<br>
searchScope=SUBTREE<br>
timeLimit=PT3S<br>
sizeLimit=1<br>
</span><br>
Note, that the <b>returnAttributes</b> line is not listing the attributes you require, thus you are ONLY getting normal attributes.<br>
<br>
Don<o:p></o:p></p>
<div>
<p class="MsoNormal">On 12/1/20 11:31 AM, Feinstein, Moses wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<pre>CAUTION: This email originated from outside of JMU. Do not click links or open attachments unless you recognize the sender and know the content is safe.<o:p></o:p></pre>
<pre>________________________________<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>** remove log file, the size was too large.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Thank you Scott. Yea, the ldapsearch example was to rule out that the account in use has sufficient permissions to pull those attributes, + extracts all operational attributes, however specifying them individually does it as well. In 4.0.1 for some reasons I simply can't get it to pull them out, it works for me in 3.3.2 version, which is almost identical in configuration minus the differences in the attribute-resolver config.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I enabled debugger for LDAP, however even in response I don't see operational attributes show up.<o:p></o:p></pre>
<pre>idp.attribute.resolver.LDAP.returnAttributes = mail displayName sn givenName uid cn isMemberOf createTimestamp<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>This is the response I get in debug mode:<o:p></o:p></pre>
<pre>2020-12-01 11:17:43,187 - 192.168.50.245 - DEBUG [org.ldaptive.SearchOperation:154] - execute response=[org.ldaptive.Response@707708292::result=[org.ldaptive.SearchResult@1972159575::entries=[[dn=uid=awong,ou=People,dc=example,dc=org[[uid[awong]], [mail[<a href="mailto:awong@example.org">awong@example.org</a>]], [givenName[Ada]], [displayName[some_display_name]], [cn[Ada D. Wong]], [sn[Wong]], [objectClass[top, person, organizationalPerson, inetOrgPerson]], [entryDN[uid=awong,ou=People,dc=example,dc=org]], [userPassword[{SSHA512}qbX9IGEjiPQsOdcHhuBNdxMmjhzrrCrxGIODgnFe5UCzo7fDSFV7mwV0KMNF9LaUz3CzxjTTO/HsiOPTNy6SrElwY9IkNUDU]]], responseControls=null, messageId=2]], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=[], messageId=2] for request=[org.ldaptive.SearchRequest@778858510::baseDn=ou=People,dc=example,dc=org, searchFilter=[org.ldaptive.SearchFilter@-2000959517::filter=(uid=awong), parameters={}], returnAttributes=[], searchScope=SUBTREE, timeLimit=PT3S, sizeLimit=<o:p></o:p></pre>
<pre> 1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler@-1580910376::dnAttributeName=entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, referralHandler=null, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1476293674::config=[<a href="mailto:org.ldaptive.ConnectionConfig@742418862::ldapUrl=ldaps://centos.example.org:1636">org.ldaptive.ConnectionConfig@742418862::ldapUrl=ldaps://centos.example.org:1636</a>, connectTimeout=PT3S, responseTimeout=PT3S, sslConfig=[<a href="mailto:org.ldaptive.ssl.SslConfig@945795630::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$$Lambda$315/0x00000001006adc40@2e9549d0">org.ldaptive.ssl.SslConfig@945795630::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$$Lambda$315/0x00000001006adc40@2e9549d0</a>, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@917687149::bindDn=cn=Directory Manager, bindSaslConfig=null, bindC<o:p></o:p></pre>
<pre> ontrols=null], <a href="mailto:connectionStrategy=org.ldaptive.ActivePassiveConnectionStrategy@1910d90c">connectionStrategy=org.ldaptive.ActivePassiveConnectionStrategy@1910d90c</a>], providerConnectionFactory=[org.ldaptive.provider.unboundid.UnboundIDConnectionFactory@1095538092::metadata=[ldapUrl=<a href="ldaps://centos.example.org:1636">ldaps://centos.example.org:1636</a>, count=1], providerConfig=[org.ldaptive.provider.unboundid.UnboundIDProviderConfig@2008506547::operationExceptionResultCodes=[SERVER_DOWN], properties={}, <a href="mailto:controlProcessor=org.ldaptive.provider.ControlProcessor@1019f8d8">controlProcessor=org.ldaptive.provider.ControlProcessor@1019f8d8</a>, connectionOptions=null, socketFactory=null, sslSocketFactory=null, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, REFERRAL]]], <a href="mailto:providerConnection=org.ldaptive.provider.unboundid.UnboundIDConnection@46c1ef9e">providerConnection=org.ldaptive.provider.unboundid.UnboundIDConnection@46c1ef9e</a>]<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Moses Feinstein<o:p></o:p></pre>
<pre>Sr. Software / IAM Engineer, App Dev Dept<o:p></o:p></pre>
<pre>Emaill: <a href="mailto:moses.feinstein@touro.edu">moses.feinstein@touro.edu</a><o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-----Original Message-----<o:p></o:p></pre>
<pre>From: users <a href="mailto:users-bounces@shibboleth.net"><users-bounces@shibboleth.net></a> On Behalf Of Cantor, Scott<o:p></o:p></pre>
<pre>Sent: Tuesday, December 1, 2020 10:38 AM<o:p></o:p></pre>
<pre>To: Shib Users <a href="mailto:users@shibboleth.net"><users@shibboleth.net></a><o:p></o:p></pre>
<pre>Subject: RE: Reading groups membership in Shibboleth 4.0.1<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>External Email<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Shibboleth doesn't do LDAP, the library it uses on top of the UnboundID client does. Nothing ldapsearch shows has anything to do with what a totally different set of code will do, it's pointless for comparison.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>I thought OpenLDAP required specifying + as a returned attribute to get operational attributes (whatever those are). Maybe other LDAP servers do.<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>-- Scott<o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>--<o:p></o:p></pre>
<pre>For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https:/wiki.shibboleth.net/confluence/x/coFAAg__;!!HoV-yHU!93H4zEgXjdtvyU-VDtUMpiyabwh5Kfmr75R-ebArTQdk5tizzyEXLWVDcgfhcVjJ_Tmw0w$">https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!HoV-yHU!93H4zEgXjdtvyU-VDtUMpiyabwh5Kfmr75R-ebArTQdk5tizzyEXLWVDcgfhcVjJ_Tmw0w$</a><o:p></o:p></pre>
<pre>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><o:p></o:p></pre>
<pre>--<o:p></o:p></pre>
<pre>For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=jIblbqS-kt0teE94XSZ4JuAfp2qJ8UkZVahy0JPh5po&s=VrafAoAUkzOhl8MMr1AV5Skwm3Zu-xZPVSyEUEfr7jE&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=jIblbqS-kt0teE94XSZ4JuAfp2qJ8UkZVahy0JPh5po&s=VrafAoAUkzOhl8MMr1AV5Skwm3Zu-xZPVSyEUEfr7jE&e=</a><o:p></o:p></pre>
<pre>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<pre>-- <o:p></o:p></pre>
<pre>D o n a l d L o h r<o:p></o:p></pre>
<pre>I n f o r m a t i o n S y s t e m s<o:p></o:p></pre>
<pre>J a m e s M a d i s o n U n i v e r s i t y<o:p></o:p></pre>
<pre>5 4 0 . 5 6 8 . 3 7 3 0<o:p></o:p></pre>
</div>
</div>
</body>
</html>