src/conf/resolver.ldap.xml

   1 <AttributeResolver xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="urn:mace:shibboleth:resolver:1.0" xsi:schemaLocation="urn:mace:shibboleth:resolver:1.0 shibboleth-resolver-1.0.xsd">
   2
   3         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonEntitlement">
   4                 <DataConnectorDependency requires="directory"/>
   5         </SimpleAttributeDefinition>
   6
   7         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonAffiliation">
   8                 <DataConnectorDependency requires="directory"/>
   9         </SimpleAttributeDefinition>
  10
  11         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonNickname">
  12                 <DataConnectorDependency requires="directory"/>
  13         </SimpleAttributeDefinition>
  14
  15         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation">
  16                 <DataConnectorDependency requires="directory"/>
  17         </SimpleAttributeDefinition>
  18
  19         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonPrimaryOrgUnitDN">
  20                 <DataConnectorDependency requires="directory"/>
  21         </SimpleAttributeDefinition>
  22
  23         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonOrgUnitDN">
  24                 <DataConnectorDependency requires="directory"/>
  25         </SimpleAttributeDefinition>
  26
  27         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonOrgDN">
  28                 <DataConnectorDependency requires="directory"/>
  29         </SimpleAttributeDefinition>
  30
  31
  32         <!-- To use these attributes, you should change the smartScope value to match your site's domain name. -->
  33         <!--
  34         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" smartScope="shibdev.edu">
  35                 <AttributeDependency requires="urn:mace:dir:attribute-def:eduPersonAffiliation"/>
  36         </SimpleAttributeDefinition>
  37
  38         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:eduPersonPrincipalName" smartScope="shibdev.edu">
  39         <DataConnectorDependency requires="directory"/>
  40         </SimpleAttributeDefinition>
  41         -->
  42
  43
  44         <!-- Example persistent id attribute.  Since this configuration is permanent, some thought is required before
  45                 deploying in  production. -->
  46         <!--
  47         <SAML2PersistentID id="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" sourceName="guid">
  48                 <DataConnectorDependency requires="echo"/>
  49                 <Salt keyStorePath="file:///usr/local/shibboleth-idp/etc/persistent.jks" keyStoreKeyAlias="handleKey" keyStorePassword="shibhs" keyStoreKeyPassword="shibhs"/>
  50         </SAML2PersistentID>
  51         -->
  52
  53
  54         <!--Examples of common ldap-based attributes -->
  55         <!--
  56         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:cn">
  57                 <DataConnectorDependency requires="directory"/>
  58         </SimpleAttributeDefinition>
  59
  60         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:sn">
  61                 <DataConnectorDependency requires="directory"/>
  62         </SimpleAttributeDefinition>
  63
  64         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:telephoneNumber">
  65                 <DataConnectorDependency requires="directory"/>
  66         </SimpleAttributeDefinition>
  67
  68         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:title">
  69                 <DataConnectorDependency requires="directory"/>
  70         </SimpleAttributeDefinition>
  71
  72         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:initials">
  73                 <DataConnectorDependency requires="directory"/>
  74         </SimpleAttributeDefinition>
  75
  76         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:description">
  77                 <DataConnectorDependency requires="directory"/>
  78         </SimpleAttributeDefinition>
  79
  80         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:carLicense">
  81                 <DataConnectorDependency requires="directory"/>
  82         </SimpleAttributeDefinition>
  83
  84         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:departmentNumber">
  85                 <DataConnectorDependency requires="directory"/>
  86         </SimpleAttributeDefinition>
  87
  88         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:displayName">
  89                 <DataConnectorDependency requires="directory"/>
  90         </SimpleAttributeDefinition>
  91
  92         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:employeeNumber">
  93                 <DataConnectorDependency requires="directory"/>
  94         </SimpleAttributeDefinition>
  95
  96         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:employeeType">
  97                 <DataConnectorDependency requires="directory"/>
  98         </SimpleAttributeDefinition>
  99
 100         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:preferredLanguage">
 101                 <DataConnectorDependency requires="directory"/>
 102         </SimpleAttributeDefinition>
 103
 104         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:manager">
 105                 <DataConnectorDependency requires="directory"/>
 106         </SimpleAttributeDefinition>
 107
 108         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:roomNumber">
 109                 <DataConnectorDependency requires="directory"/>
 110         </SimpleAttributeDefinition>
 111
 112         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:seeAlso">
 113                 <DataConnectorDependency requires="directory"/>
 114         </SimpleAttributeDefinition>
 115
 116         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:facsimileTelephoneNumber">
 117                 <DataConnectorDependency requires="directory"/>
 118         </SimpleAttributeDefinition>
 119
 120         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:street">
 121                 <DataConnectorDependency requires="directory"/>
 122         </SimpleAttributeDefinition>
 123
 124         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:postOfficeBox">
 125                 <DataConnectorDependency requires="directory"/>
 126         </SimpleAttributeDefinition>
 127
 128         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:postalCode">
 129                 <DataConnectorDependency requires="directory"/>
 130         </SimpleAttributeDefinition>
 131
 132         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:st">
 133                 <DataConnectorDependency requires="directory"/>
 134         </SimpleAttributeDefinition>
 135
 136         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:givenName">
 137                 <DataConnectorDependency requires="directory"/>
 138         </SimpleAttributeDefinition>
 139
 140         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:l">
 141                 <DataConnectorDependency requires="directory"/>
 142         </SimpleAttributeDefinition>
 143
 144         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:businessCategory">
 145                 <DataConnectorDependency requires="directory"/>
 146         </SimpleAttributeDefinition>
 147
 148         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:ou">
 149                 <DataConnectorDependency requires="directory"/>
 150         </SimpleAttributeDefinition>
 151
 152         <SimpleAttributeDefinition id="urn:mace:dir:attribute-def:physicalDeliveryOfficeName">
 153                 <DataConnectorDependency requires="directory"/>
 154         </SimpleAttributeDefinition>
 155         -->
 156
 157
 158         <JNDIDirectoryDataConnector id="directory">
 159                 <Search filter="cn=%PRINCIPAL%">
 160                         <Controls searchScope="SUBTREE_SCOPE" returningObjects="false" />
 161                 </Search>
 162                 <Property name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory" />
 163                 <Property name="java.naming.provider.url" value="ldap://ldap.example.edu/dc=example,dc=edu" />
 164                 <Property name="java.naming.security.principal" value="cn=admin,dc=example,dc=edu" />
 165                 <Property name="java.naming.security.credentials" value="examplepw" />
 166         </JNDIDirectoryDataConnector>
 167
 168
 169         <!-- An example of how to do a simple ldap bind over SSL -->
 170         <!--
 171         <JNDIDirectoryDataConnector id="directorySecure">
 172                 <Search filter="cn=%PRINCIPAL%">
 173                         <Controls searchScope="SUBTREE_SCOPE" returningObjects="false" />
 174                 </Search>
 175                 <Property name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory" />
 176                 <Property name="java.naming.provider.url" value="ldap://ldap.example.edu:636/dc=example,dc=edu" />
 177                 <Property name="java.naming.security.protocol" value="ssl" />
 178                 <Property name="java.naming.security.principal" value="cn=admin,dc=example,dc=edu" />
 179                 <Property name="java.naming.security.credentials" value="examplepw" />
 180         </JNDIDirectoryDataConnector>
 181         -->
 182
 183
 184         <!-- An example of how to setup ldap with connection pooling -->
 185         <!--
 186         <JNDIDirectoryDataConnector id="directoryPooled">
 187                 <Search filter="cn=%PRINCIPAL%">
 188                         <Controls searchScope="SUBTREE_SCOPE" returningObjects="false" />
 189                 </Search>
 190                 <Property name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory" />
 191                 <Property name="java.naming.provider.url" value="ldap://ldap.example.edu/dc=example,dc=edu" />
 192                 <Property name="com.sun.jndi.ldap.connect.pool" value="true" />
 193                 <Property name="com.sun.jndi.ldap.connect.pool.initsize" value="5" />
 194                 <Property name="com.sun.jndi.ldap.connect.pool.prefsize" value="5" />
 195                 <Property name="com.sun.jndi.ldap.connect.pool.authentication" value="none simple DIGEST-MD5" />
 196                 <Property name="com.sun.jndi.ldap.connect.pool.protocol" value="plain ssl" />
 197         </JNDIDirectoryDataConnector>
 198         -->
 199
 200 </AttributeResolver>