<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
If you break apart your log data, here's what I see referring to the
following portion of your log:<br>
<br>
<font face="monospace">[org.ldaptive.SearchOperation:154] - execute
response=<br>
</font><br>
You see this:<br>
<br>
<font face="monospace">[[dn=uid=awong,ou=People,dc=example,dc=org[[uid[awong]],
[mail[<a class="moz-txt-link-abbreviated" href="mailto:awong@example.org">awong@example.org</a>]], [givenName[Ada]],
[displayName[some_display_name]], [cn[Ada D. Wong]], [sn[Wong]],
[objectClass[top, person, organizationalPerson, inetOrgPerson]],
[entryDN[uid=awong,ou=People,dc=example,dc=org]],
[userPassword[{SSHA512}qbX9IGEjiPQsOdcHhuBNdxMmjhzrrCrxGIODgnFe5UCzo7fDSFV7mwV0KMNF9LaUz3CzxjTTO/HsiOPTNy6SrElwY9IkNUDU]]],<br>
</font><br>
...if you break it down and make it look similar to the results
returned from a command-line ldapsearch, you will find:<br>
<br>
<font face="monospace">dn=uid=awong,ou=People,dc=example,dc=org<br>
uid[awong]<br>
mail[<a class="moz-txt-link-abbreviated" href="mailto:awong@example.org">awong@example.org</a>]<br>
givenName[Ada]<br>
displayName[some_display_name]<br>
cn[Ada D. Wong]<br>
sn[Wong]<br>
<b>objectClass</b>[top, person, organizationalPerson,
inetOrgPerson]<br>
<b>entryDN</b>[uid=awong,ou=People,dc=example,dc=org]<br>
<b>userPassword</b>[{SSHA512}qbX9IGEjiPQsOdcHhuBNdxMmjhzrrCrxGIODgnFe5UCzo7fDSFV7mwV0KMNF9LaUz3CzxjTTO/HsiOPTNy6SrElwY9IkNUDU]<br>
</font><br>
Based on the attribute list you say you are asking for:<br>
<pre class="moz-quote-pre" wrap="">mail displayName sn givenName uid cn isMemberOf createTimestamp</pre>
...your shib/ldap config is ONLY getting back the normal attributes
that are available. I say that because, objectClass, entryDN and
userPassword are in the returned results and these were not asked
for.<br>
<br>
So this tells me your Shib/ldap config is not asking for what you
want.<br>
<br>
If you look at another portion of your log, you will see:<br>
<br>
<font face="monospace">baseDn=ou=People,dc=example,dc=org,
searchFilter=[org.ldaptive.SearchFilter@-2000959517::filter=(uid=awong),
parameters={}], returnAttributes=[], searchScope=SUBTREE,
timeLimit=PT3S, sizeLimit=1,<br>
</font><br>
...if you break it down, you see the following:<br>
<br>
<font face="monospace">baseDn=ou=People,dc=example,dc=org<br>
filter=(uid=awong)<br>
<b>returnAttributes</b>=[]<br>
searchScope=SUBTREE<br>
timeLimit=PT3S<br>
sizeLimit=1<br>
</font><br>
Note, that the <b>returnAttributes</b> line is not listing the
attributes you require, thus you are ONLY getting normal attributes.<br>
<br>
Don<br>
<br>
<div class="moz-cite-prefix">On 12/1/20 11:31 AM, Feinstein, Moses
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:BL0PR0102MB3457030F99E70212911276A9FBF40@BL0PR0102MB3457.prod.exchangelabs.com">
<pre class="moz-quote-pre" wrap="">CAUTION: This email originated from outside of JMU. Do not click links or open attachments unless you recognize the sender and know the content is safe.
________________________________
** remove log file, the size was too large.
Thank you Scott. Yea, the ldapsearch example was to rule out that the account in use has sufficient permissions to pull those attributes, + extracts all operational attributes, however specifying them individually does it as well. In 4.0.1 for some reasons I simply can't get it to pull them out, it works for me in 3.3.2 version, which is almost identical in configuration minus the differences in the attribute-resolver config.
I enabled debugger for LDAP, however even in response I don't see operational attributes show up.
idp.attribute.resolver.LDAP.returnAttributes = mail displayName sn givenName uid cn isMemberOf createTimestamp
This is the response I get in debug mode:
2020-12-01 11:17:43,187 - 192.168.50.245 - DEBUG [org.ldaptive.SearchOperation:154] - execute response=[org.ldaptive.Response@707708292::result=[org.ldaptive.SearchResult@1972159575::entries=[[dn=uid=awong,ou=People,dc=example,dc=org[[uid[awong]], [mail[<a class="moz-txt-link-abbreviated" href="mailto:awong@example.org">awong@example.org</a>]], [givenName[Ada]], [displayName[some_display_name]], [cn[Ada D. Wong]], [sn[Wong]], [objectClass[top, person, organizationalPerson, inetOrgPerson]], [entryDN[uid=awong,ou=People,dc=example,dc=org]], [userPassword[{SSHA512}qbX9IGEjiPQsOdcHhuBNdxMmjhzrrCrxGIODgnFe5UCzo7fDSFV7mwV0KMNF9LaUz3CzxjTTO/HsiOPTNy6SrElwY9IkNUDU]]], responseControls=null, messageId=2]], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=[], messageId=2] for request=[org.ldaptive.SearchRequest@778858510::baseDn=ou=People,dc=example,dc=org, searchFilter=[org.ldaptive.SearchFilter@-2000959517::filter=(uid=awong), parameters={}], returnAttributes=[], searchScope=SUBTREE, timeLimit=PT3S, sizeLimit=
1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler@-1580910376::dnAttributeName=entryDN, addIfExists=false]], searchReferenceHandlers=null, controls=null, referralHandler=null, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@1476293674::config=[<a class="moz-txt-link-abbreviated" href="mailto:org.ldaptive.ConnectionConfig@742418862::ldapUrl=ldaps://centos.example.org:1636">org.ldaptive.ConnectionConfig@742418862::ldapUrl=ldaps://centos.example.org:1636</a>, connectTimeout=PT3S, responseTimeout=PT3S, sslConfig=[<a class="moz-txt-link-abbreviated" href="mailto:org.ldaptive.ssl.SslConfig@945795630::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$$Lambda$315/0x00000001006adc40@2e9549d0">org.ldaptive.ssl.SslConfig@945795630::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$$Lambda$315/0x00000001006adc40@2e9549d0</a>, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer@917687149::bindDn=cn=Directory Manager, bindSaslConfig=null, bindC
ontrols=null], connectionStrategy=org.ldaptive.ActivePassiveConnectionStrategy@1910d90c], providerConnectionFactory=[org.ldaptive.provider.unboundid.UnboundIDConnectionFactory@1095538092::metadata=[ldapUrl=<a class="moz-txt-link-freetext" href="ldaps://centos.example.org:1636">ldaps://centos.example.org:1636</a>, count=1], providerConfig=[org.ldaptive.provider.unboundid.UnboundIDProviderConfig@2008506547::operationExceptionResultCodes=[SERVER_DOWN], properties={}, controlProcessor=org.ldaptive.provider.ControlProcessor@1019f8d8, connectionOptions=null, socketFactory=null, sslSocketFactory=null, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, REFERRAL]]], providerConnection=org.ldaptive.provider.unboundid.UnboundIDConnection@46c1ef9e]
Moses Feinstein
Sr. Software / IAM Engineer, App Dev Dept
Emaill: <a class="moz-txt-link-abbreviated" href="mailto:moses.feinstein@touro.edu">moses.feinstein@touro.edu</a>
-----Original Message-----
From: users <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.net"><users-bounces@shibboleth.net></a> On Behalf Of Cantor, Scott
Sent: Tuesday, December 1, 2020 10:38 AM
To: Shib Users <a class="moz-txt-link-rfc2396E" href="mailto:users@shibboleth.net"><users@shibboleth.net></a>
Subject: RE: Reading groups membership in Shibboleth 4.0.1
External Email
Shibboleth doesn't do LDAP, the library it uses on top of the UnboundID client does. Nothing ldapsearch shows has anything to do with what a totally different set of code will do, it's pointless for comparison.
I thought OpenLDAP required specifying + as a returned attribute to get operational attributes (whatever those are). Maybe other LDAP servers do.
-- Scott
--
For Consortium Member technical support, see <a class="moz-txt-link-freetext" href="https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!HoV-yHU!93H4zEgXjdtvyU-VDtUMpiyabwh5Kfmr75R-ebArTQdk5tizzyEXLWVDcgfhcVjJ_Tmw0w$">https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!HoV-yHU!93H4zEgXjdtvyU-VDtUMpiyabwh5Kfmr75R-ebArTQdk5tizzyEXLWVDcgfhcVjJ_Tmw0w$</a>
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
--
For Consortium Member technical support, see <a class="moz-txt-link-freetext" href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=jIblbqS-kt0teE94XSZ4JuAfp2qJ8UkZVahy0JPh5po&s=VrafAoAUkzOhl8MMr1AV5Skwm3Zu-xZPVSyEUEfr7jE&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=Pa2DB88IW_s2TyLfktHtWA&m=jIblbqS-kt0teE94XSZ4JuAfp2qJ8UkZVahy0JPh5po&s=VrafAoAUkzOhl8MMr1AV5Skwm3Zu-xZPVSyEUEfr7jE&e=</a>
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a>
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
</pre>
</body>
</html>