<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
That worked like a charm! Thank you so much for the tip, Matt.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
As soon as I added <InputDataConnector> like you pointed out, it immediately worked.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
-Johnny Z</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof ContentPasted0">
<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Matt Brennan <brennanma@gmail.com><br>
<b>Sent:</b> Monday, April 17, 2023 4:42 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Zhang, Jianjun <jianjun.zhang@accenturefederal.com><br>
<b>Subject:</b> [External] Re: Search 2nd LDAP using an attribute returned from 1st LDAP</font>
<div> </div>
</div>
<div>
<table border="0" cellspacing="0" cellpadding="0" width="100%" align="left" style="border:0; display:table; width:100%; table-layout:fixed; border-collapse:seperate; float:none">
<tbody style="display:block">
<tr>
<td valign="middle" width="1px" bgcolor="#A6A6A6" cellpadding="7px 2px 7px 2px" style="padding:7px 2px 7px 2px; background-color:#A6A6A6">
</td>
<td valign="middle" width="100%" bgcolor="#EAEAEA" cellpadding="7px 5px 7px 15px" color="#212121" style="width:100%; background-color:#EAEAEA; padding:7px 5px 7px 15px; font-family:wf_segoe-ui_normal,Segoe UI,Segoe WP,Tahoma,Arial,sans-serif; font-size:12px; font-weight:normal; color:#212121; text-align:left; word-wrap:break-word">
<div>You don't often get email from brennanma@gmail.com. <a href="https://aka.ms/LearnAboutSenderIdentification">
Learn why this is important</a></div>
</td>
<td valign="middle" align="left" width="75px" bgcolor="#EAEAEA" cellpadding="7px 5px 7px 5px" color="#212121" style="width:75px; background-color:#EAEAEA; padding:7px 5px 7px 5px; font-family:wf_segoe-ui_normal,Segoe UI,Segoe WP,Tahoma,Arial,sans-serif; font-size:12px; font-weight:normal; color:#212121; text-align:left; word-wrap:break-word">
</td>
</tr>
</tbody>
</table>
<div><br>
<div style="color:red; font-family:Arial,Helvetica,sans-serif; font-size:14px; text-align:center">
This message is from an EXTERNAL SENDER - be CAUTIOUS of links and attachments. THINK BEFORE YOU CLICK.</div>
<hr style="border-color:red">
<br>
<div>
<div dir="ltr">Assuming that this configuration isn't now deprecated (I'm a little out of date), you need an InputDataConnector attribute.
<div><br>
</div>
<div>I do this in order to do a recursive AD group membership listing for my users. My second connector looks like this: </div>
<div><br>
</div>
<div><!-- AD Group Recursive Resolver --><br>
<DataConnector id="ADGroup" xsi:type="LDAPDirectory"<br>
ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"<br>
baseDN="DC=corp,DC=contoso,DC=com"<br>
principal="%{idp.attribute.resolver.LDAP.bindDN}"<br>
principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"<br>
trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"<br>
useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"<br>
maxResultSize="1000"><br>
<InputDataConnector ref="Contoso-AD" attributeNames="distinguishedName" /><br>
<FilterTemplate><br>
<![CDATA[<br>
(member:1.2.840.113556.1.4.1941:=$distinguishedName.get(0))<br>
]]><br>
</FilterTemplate><br>
<ReturnAttributes>cn</ReturnAttributes><br>
<LDAPProperty name="java.naming.referral" value="follow" /><br>
</DataConnector><br>
</div>
<div><br>
</div>
<div>-Matt</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Mon, 17 Apr 2023 at 15:42, Zhang, Jianjun via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div class="x_msg-4687880725698593285">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Hi,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
I have 2 separate LDAP repositories that are attached to the Shibboleth 4.3 idp. I get the attributes back from the 1<span><sup>st</sup> LDAP during authentication with a search filter like this in attribute-resolver.xml:</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<span><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<span> <DataConnector id="LDAP-1" xsi:type="LDAPDirectory"<br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<span><span> </span>....<br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<span> <span> </span>exportAttributes="uid1,uid2,mail,name">
<div> <span> </span><FilterTemplate></div>
<div> <span> </span><![CDATA[</div>
<div> <span> </span><span> </span>(uid1=$resolutionContext.principal)</div>
<span> </span><span> </span> ]]></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<span><span> </span></FilterTemplate><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
</DataConnector></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
This works and it returns all attributes correctly from LDAP-1.<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
I need to use the returned uid2 of LDAP-1 to search the 2<span><sup>nd</sup> LDAP to return more attributes, but not sure how I can do it. I tried something like:</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<span style="font-size:12pt; background-color:rgb(255,255,255)"><span><DataConnector id="LDAP-2" xsi:type="LDAPDirectory"<br>
</span></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<div style="font-size:12pt; background-color:rgb(255,255,255)"><span><span> </span>....<br>
</span></div>
<div style="font-size:12pt; background-color:rgb(255,255,255)"><span> <span> </span>exportAttributes="uid2,auxAttr1,auxAttr2">
<div> <span> </span><FilterTemplate></div>
<div> <span> </span><![CDATA[</div>
<div> <span> </span><span> <span> </span><span> </span>#set ($uid2value=
<span>$uid2.get(0)</span>)</span><br>
</div>
<div> <span> </span><span> </span> (uid2=$uid2value)</div>
<span> </span><span> </span> ]]></span></div>
<div style="font-size:12pt; background-color:rgb(255,255,255)"><span><span> </span></FilterTemplate><br>
</span></div>
<span style="font-size:12pt; background-color:rgb(255,255,255)"></DataConnector></span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
But it does not work. It seems it can't resolve $uid2value in the search filter to actual value of uid2.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Are you able to point me a direction how I should do this? Thank you very much in advance.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Johnny Zhang</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" originalsrc="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" shash="BSKry4h7/SeBB0Hslw0X0QqJL18xNnZEAzdNqKNUQJVDYXBO8eF4HUdwMhzyLKr+rknW7yh6mUXVd5Bin9QdrhYgBF9UCuQHZuwqocHUmDaQUbABla+c/IwdVBkFcC4zQaFmNboUmCz+TYOtEEv0LAAcqDEKDjIBlyaNeZXK/G4=" rel="noreferrer" target="_blank">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>