<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The issue appears to be with reading any operational attributes from the LDAP (opendj)
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The issue is definitely not with permissions since I am using Directory Manager and I am able to run ldapsearch and extract these attributes.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I can extract “standard” attribute (uid, sn, givenName) but not operational (createTimestamp, isMemberOf)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Not sure why shibboleth does not pull operational attributes from ldap when explicitly specified.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal">Ldap.properties:<o:p></o:p></p>
<p class="MsoNormal"> idp.attribute.resolver.LDAP.returnAttributes = mail displayName sn givenName uid cn isMemberOf createTimestamp<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">attribute-resolvver:<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><AttributeDefinition xsi:type="Simple" id="isMemberOf"><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <InputDataConnector ref="myLDAP" attributeNames="isMemberOf" /><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"></AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><AttributeDefinition id="membership" xsi:type="Mapped"><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <InputAttributeDefinition ref="isMemberOf" /><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <DefaultValue passThru="true"/><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <ValueMap><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <ReturnValue>return_membership</ReturnValue><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <SourceValue caseSensitive="false">cn=testgroup,ou=Groups,dc=example,dc=org</SourceValue><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> </ValueMap><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <AttributeEncoder xsi:type="SAML2String" name="membership" friendlyName="membership" encodeType="false" /><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"></AttributeDefinition><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> principal="%{idp.attribute.resolver.LDAP.bindDN}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:false}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> exportAttributes="%{idp.attribute.resolver.LDAP.returnAttributes}"><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p>
</o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <o:p>
</o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <FilterTemplate><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <![CDATA[<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> %{idp.attribute.resolver.LDAP.searchFilter}<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> ]]><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> </FilterTemplate><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> <ConnectionPool<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> minPoolSize="%{idp.pool.LDAP.minSize:3}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> validateDN="%{idp.pool.LDAP.validateDN:}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"> </DataConnector><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am able to perform ldap search and return these attributes without any issues using the same account.
<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">sh ldapsearch --port 1636 --hostname localhost --trustAll --useSSL --bindDN "cn=Directory Manager" -b "dc=example,dc=org" "(uid=awong)" uid mail isMemberOf createTimestamp<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">dn: uid=awong,ou=People,dc=example,dc=org<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">mail: awong@example.org<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">uid: awong<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">createTimestamp: 20201126184936Z<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">isMemberOf: cn=testgroup,ou=Groups,dc=example,dc=org<o:p></o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas;color:#44546A"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas;color:#44546A"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:Consolas;color:#44546A"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt">Moses Feinstein<o:p></o:p></span></b></p>
<p class="MsoNormal"><i><span style="font-size:8.0pt;color:#767171">Sr. Software / IAM Engineer, App Dev Dept<o:p></o:p></span></i></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt">Emaill</span></b><span style="font-size:8.0pt">:
</span><a href="mailto:moses.feinstein@touro.edu"><span style="font-size:8.0pt;color:#0563C1">moses.feinstein@touro.edu</span></a><span style="font-size:8.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Daniel Fisher<br>
<b>Sent:</b> Monday, November 30, 2020 5:11 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Reading groups membership in Shibboleth 4.0.1<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid black 1.5pt;padding:1.0pt 1.0pt 1.0pt 1.0pt;overflow:float:left">
<p class="MsoNormal" style="background:yellow"><strong><span style="font-family:"Calibri",sans-serif;color:red">External Email</span></strong><o:p></o:p></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">On Mon, Nov 30, 2020 at 10:01 AM Feinstein, Moses <</span><a href="mailto:moses.feinstein@touro.edu"><span style="font-family:"Arial",sans-serif">moses.feinstein@touro.edu</span></a><span style="font-family:"Arial",sans-serif">>
wrote:</span><span style="font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
</div>
</div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Below configuration works, if I substitute “isMemberOf” in attribute resolver with any other attribute (displayName for example), however for some reason it is unable to read “isMemberOf”,
it returns nothing for the group membership even though the user is a member of the group (cn=testgroup,ou=Groups,dc=example,dc=org).
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Since “isMemberOf” is part of operational attributes, I am not sure if there is anything else that needs to be configured on Shibboleth side.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Am I missing something in my configuration below to be able to read operational attribute “isMemberOf” from the LDAP?<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">What does your DataConnector configuration look like? Assuming the permissions are correct, requesting isMemberOf specifically is all you need to do.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">--Daniel Fisher<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>