<div dir="ltr">Hi,<div><br></div><div>i'm trying to set up Ldap nested groups on my Shibboleth 4.1.2 but it seems that the value of $distinguishedName.get(0) is never replaced by the attribute resolved by my dependent LDAP DataConnector.</div><div><br></div><div>The first Ldap Data Connector retrieve the distinguishedName from my OpenLDAP and that work fine because in the OpenLDAP logs i see the request with no errors (i have also done the same request with ldapsearch) :</div><div><br></div>slapd[765]: conn=1975922 op=1 SRCH base="dc=example,dc=com" scope=2 deref=0 filter="(uid=testuser)"<br>slapd[765]: conn=1975922 op=1 SRCH attr=distinguishedName<br>slapd[765]: conn=1975922 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=<br><div> </div><div>But on my Shibboleth logs i always have this error :</div><div><br></div><div>ERROR [net.shibboleth.idp.profile.impl.ResolveAttributes:300] - Profile Action ResolveAttributes: Error resolving attributes<br>net.shibboleth.idp.attribute.resolver.ResolutionException: Data Connector 'myLDAPGroups': Unable to execute LDAP search<br>        at net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector.retrieveAttributes(LDAPDataConnector.java:225)<br>Caused by: org.ldaptive.LdapException: LDAPException(resultCode=87 (filter error), numEntries=0, numReferences=0, errorMessage='Unable to parse string '(&(objectClass=groupOfUniqueNames)(uniquemember=$distinguishedName.get(0)))' as an LDAP filter because it contains an unexpected opening parenthesis at position 71.', ldapSDKVersion=4.0.14, revision=c0fb784eebf9d36a67c736d0428fb3577f2e25bb')<br></div><div><br></div><div>So, it seems that $distinguishedName.get(0) is never replaced by the value returned by the Primary LdapConnector. I don't understand why because i have followed the documentation (<a href="https://wiki.shibboleth.net/confluence/display/IDP4/LDAPNestedGroups">https://wiki.shibboleth.net/confluence/display/IDP4/LDAPNestedGroups</a>) and for me my configuration looks fine.</div><div><br></div><div>I know i'm missing something and i keep looking. But if someone can help me to find what i'm doing wrong, that would be really nice.</div><div><br></div><div>I'm using Shibboleth IDP v4.1.2 with tomcat 9.0.31 and openjdk 11.0.11 on Debian 10 server.</div><div><br></div><div>And here is my attribute-resolver.xml configuration :</div><div><br></div><div><!--Attributes definition--></div><div><AttributeDefinition id="distinguishedName" xsi:type="Simple"><br>  <InputDataConnector ref="myLDAP" attributeNames="distinguishedName" /><br>  <AttributeEncoder xsi:type="SAML2ScopedString" name="distinguishedName" friendlyName="distinguishedName" encodeType="false" /><br></AttributeDefinition><br><br><AttributeDefinition id="isMemberOfRecursive" xsi:type="Simple"><br>  <InputDataConnector ref="myLDAPGroups" attributeNames="cn" /><br>  <AttributeEncoder xsi:type="SAML2String" name="isMemberOf" friendlyName="isMemberOf" /><br></AttributeDefinition><br></div><div><br></div><div><!--Primary LdapConnector--></div><div>    <DataConnector id="myLDAP" xsi:type="LDAPDirectory"<br>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br>        principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"<br>        trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"><br>        <FilterTemplate><br>            <![CDATA[<br>                %{idp.attribute.resolver.LDAP.searchFilter}<br>            ]]><br>        </FilterTemplate><br>        <ReturnAttributes>distinguishedName</ReturnAttributes><br>        <ConnectionPool<br>            minPoolSize="%{idp.pool.LDAP.minSize:3}"<br>            maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br>            blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br>            validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br>            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<br>            expirationTime="%{idp.pool.LDAP.idleTime:PT10M}" /> <br>    </DataConnector><br></div><div><div><br></div><div><!--NestedGroups LdapConnector--></div><div>    <DataConnector id="myLDAPGroups" xsi:type="LDAPDirectory"<br>        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" <br>        principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"<br>        trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br>        maxResultSize="0"><br><br>        <InputDataConnector ref="myLDAP" attributeNames="distinguishedName" /><br>        <FilterTemplate><br>            <![CDATA[<br>                (&(objectClass=groupOfUniqueNames)(uniquemember=$distinguishedName.get(0)))<br>            ]]><br>        </FilterTemplate><br>        <ReturnAttributes>cn</ReturnAttributes><br>        <ConnectionPool<br>            minPoolSize="%{idp.pool.LDAP.minSize:3}"<br>            maxPoolSize="%{idp.pool.LDAP.maxSize:10}"<br>            blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"<br>            validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"<br>            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"<br>            expirationTime="%{idp.pool.LDAP.idleTime:PT10M}" /><br>    </DataConnector><br></div><div><br></div><div>Thanks</div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature">Armando Martins<br></div></div></div>