<div dir="ltr">Assuming that this configuration isn't now deprecated (I'm a little out of date), you need an InputDataConnector attribute. <div><br></div><div>I do this in order to do a recursive AD group membership listing for my users. My second connector looks like this: </div><div><br></div><div><!-- AD Group Recursive Resolver --><br><DataConnector id="ADGroup" xsi:type="LDAPDirectory"<br>  ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>  baseDN="DC=corp,DC=contoso,DC=com"<br>  principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>  principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>  trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br>  useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"<br>  maxResultSize="1000"><br>  <InputDataConnector ref="Contoso-AD" attributeNames="distinguishedName" /><br>  <FilterTemplate><br>    <![CDATA[<br>      (member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))<br>    ]]><br>  </FilterTemplate><br>  <ReturnAttributes>cn</ReturnAttributes><br>  <LDAPProperty name="java.naming.referral" value="follow" /><br></DataConnector><br></div><div><br></div><div>-Matt</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, 17 Apr 2023 at 15:42, Zhang, Jianjun via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-4687880725698593285">




<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Hi,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
I have 2 separate LDAP repositories that are attached to the Shibboleth 4.3 idp. I get the attributes back from the 1<span>^st LDAP during authentication with a search filter like this in attribute-resolver.xml:</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<span> <DataConnector id="LDAP-1" xsi:type="LDAPDirectory"<br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<span><span>      </span>....<br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<span>     <span> </span>exportAttributes="uid1,uid2,mail,name">
<div> <span>     </span><FilterTemplate></div>
<div>            <span>      </span><![CDATA[</div>
<div>                <span>  </span><span>      </span>(uid1=$resolutionContext.principal)</div>
           <span> </span><span>      </span> ]]></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<span><span>      </span></FilterTemplate><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
</DataConnector></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
This works and it returns all attributes correctly from LDAP-1.<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
I need to use the returned uid2 of LDAP-1 to search the 2<span>^nd LDAP to return more attributes, but not sure how I can do it. I tried something like:</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<span style="font-size:12pt;background-color:rgb(255,255,255)"><span><DataConnector id="LDAP-2" xsi:type="LDAPDirectory"<br>
</span></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<div style="font-size:12pt;background-color:rgb(255,255,255)"><span><span>      </span>....<br>
</span></div>
<div style="font-size:12pt;background-color:rgb(255,255,255)"><span>     <span> </span>exportAttributes="uid2,auxAttr1,auxAttr2">
<div> <span>     </span><FilterTemplate></div>
<div>            <span>      </span><![CDATA[</div>
<div> <span>     </span><span> <span>     </span><span>     </span>#set ($uid2value=
<span>$uid2.get(0)</span>)</span><br>
</div>
<div>               <span>   </span><span>      </span> (uid2=$uid2value)</div>
           <span> </span><span>      </span> ]]></span></div>
<div style="font-size:12pt;background-color:rgb(255,255,255)"><span><span>      </span></FilterTemplate><br>
</span></div>
<span style="font-size:12pt;background-color:rgb(255,255,255)"></DataConnector></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
But it does not work. It seems it can't resolve $uid2value in the search filter to actual value of uid2.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Are you able to point me a direction how I should do this? Thank you very much in advance.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
Johnny Zhang</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255)">
<br>
</div>
</div>

-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></blockquote></div>