<div dir="ltr"><div>Hi Scott and Peter!!</div><div><br></div><div>I really appreciate your responses/comments, especially Scott's comments about the attribute resolver... it is a LOT of information, especially conceptually, to digest for a newbie and the "glue" to the different pieces of information is the hardest part to try to understand. I mean I feel like I have a LOT of experience with federation, LDAPs, etc., but most of my work has been with COTS products, and some of the concepts in Shibboleth are still a little new to me, so it is taking a while for me. <br></div><div><br></div><div>I think that I am kind of a "learn by doing" type person, so, personally, it is important in my learning process to get something, even something simple, working, and then I can go from there, so that is currently what I am trying to get to/achieve. Even if I can get just one of 2 attributes and mainly, the nameid part working, that would be a great starting point.</div><div><br></div><div>As far as specifics, as mentioned, I am using OpenDJ (I tend to use OpenDJ in development, because it includes a control panel for administration, plus a standalone LDAP instance, in one package, but I have used Oracle OUD, AD, and even the old Oracle OID and the original SunDS, for years). OpenDJ includes a standard LDAP schema, similar to SunDS, I think, and currently I've configured the BEGINNING part of the Shib ldap properties:</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">==================================================================================</blockquote><blockquote># LDAP authentication (and possibly attribute resolver) configuration<br># Note, this doesn't apply to the use of JAAS authentication via LDAP<br><br>## Authenticator strategy, either anonSearchAuthenticator, bindSearchAuthenticator, directAuthenticator, adAuthenticator<br>idp.authn.LDAP.authenticator = anonSearchAuthenticator<br><br>## Connection properties ##<br>idp.authn.LDAP.ldapURL = ldap://localhost:1389<br>idp.authn.LDAP.useStartTLS = false<br># Time to wait for startTLS responses<br>#idp.authn.LDAP.startTLSTimeout = PT3S<br># Time to wait for connections to open<br>#idp.authn.LDAP.connectTimeout = PT3S<br># Time to wait for operation responses (e.g. search, bind)<br>#idp.authn.LDAP.responseTimeout = PT3S<br># Connection strategy to use when multiple URLs are supplied, either ACTIVE_PASSIVE, ROUND_ROBIN, RANDOM<br>#idp.authn.LDAP.connectionStrategy = ACTIVE_PASSIVE<br><br>## SSL configuration, either jvmTrust, certificateTrust, or keyStoreTrust<br>#idp.authn.LDAP.sslConfig = certificateTrust<br>## If using certificateTrust above, set to the trusted certificate's path<br>#idp.authn.LDAP.trustCertificates = %{idp.home}/credentials/ldap-server.crt<br>## If using keyStoreTrust above, set to the truststore path<br>#idp.authn.LDAP.trustStore = %{idp.home}/credentials/ldap-server.truststore<br><br>## Return attributes during authentication<br># Setting this property will cause entry resolution to occur as part of authentication<br># Note that this property is not compatible with the adAuthenticator<br>#idp.authn.LDAP.returnAttributes = passwordExpirationTime,loginGraceRemaining<br><br>## DN resolution properties ##<br><br># Search DN resolution, used by anonSearchAuthenticator, bindSearchAuthenticator<br># for AD: CN=Users,DC=example,DC=org<br>idp.authn.LDAP.baseDN = ou=people,dc=xxxx,dc=com<br>idp.authn.LDAP.subtreeSearch = true<br>idp.authn.LDAP.userFilter = (cn={user})<br># bind search configuration<br># for AD: idp.authn.LDAP.bindDN=<a href="mailto:adminuser@domain.com">adminuser@domain.com</a><br>idp.authn.LDAP.bindDN = cn=directory manager<br><br># Format DN resolution, used by directAuthenticator, adAuthenticator<br># for AD use idp.authn.LDAP.dnFormat=%<a href="mailto:s@domain.com">s@domain.com</a><br>idp.authn.LDAP.dnFormat = cn=%s,ou=people,dc=xxxx,dc=com<br></blockquote><blockquote>===========================================================================</blockquote><div><br></div><div><br></div><div>I have not changed anything in saml-nameid.xml or attribute-resolver.xml (I did make changes which caused the IdP to fail to start earlier, but I've since restored them to original).</div><div><br></div><div>Jim</div><div><br></div><div><br></div></div><div id="DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2"><br><table style="border-top:1px solid #d3d4de"><tr><td style="width:55px;padding-top:13px"><a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank"><img src="https://s-install.avcdn.net/ipm/preview/icons/icon-envelope-tick-round-orange-animated-no-repeat-v1.gif" alt="" width="46" height="29" style="width: 46px; height: 29px;"></a></td><td style="width:470px;padding-top:12px;color:#41424e;font-size:13px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Virus-free.<a href="https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail" target="_blank" style="color:#4453ea">www.avast.com</a></td></tr></table><a href="#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width="1" height="1"></a></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Apr 9, 2025 at 8:37 AM Cantor, Scott via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> I was seeing errors in the idp-warn.log about missing > <br>
> certificat (.crt) files, even though I have TLS set to 'false' in <br>
> the ldap.properties file.<br>
<br>
That's doesn't mean you're not applying other settings that assume they exist.<br>
<br>
But using ldap:// instead of ldaps:// with the startTLS setting off should not result in actual use of TLS in either of the two ways it gets used. jvmTrust is probably a reasonable fallback option to set when not using TLS at all since it shouldn't matter and doesn't require additional setup.<br>
<br>
As for the documentation, I don't think the resolver material is approachable, it doesn't explain any concepts. A section outlining what it's really doing and how the connectors and definitions get applied is needed.<br>
<br>
Having said which, the LDAP data connector topic should be all anybody needs to set up a query, not to mention there's a specific example file in the install for LDAP.<br>
<br>
But as for the NameID generation matetrial: that is as good as it's ever going to get IMHO.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>