Yea we run 2 forests here. One for staff and one for student. If I could see an example file of resolver.xml pulling attributes being pulled out of AD that would be a great help
Paul Cheyne
Support Consultant
RM (Aberdeen College)
Tel: 01224 (61)2550
Email: [log in to unmask]
-----Original Message-----
From: Discussion list for Shibboleth developments [mailto:[log in to unmask]] On Behalf Of Rod Widdowson
Sent: 06 May 2009 10:34
To: [log in to unmask]
Subject: Re: Attribute Definitions and metadatatool
> How do I go about mapping the eduperson atrtributes to attributes in
> Active directory
> eduPersonTargetID
A common place to start with this is objectSID - this has the correct attributes for what you need in terms of resuse. Beware however that it is binary, http://www.ukfederation.org.uk/content/Documents/EPTIDDefnProblem
not only describes how to get around that, it has some XML you can use.
> eduPersonPrincipalName
Very rarely needed. Source it from sAMAccountName
So that leaves you with EpSA and EpE. EpE is likely to be harder, but OTOH it is less widespread.
People often have a lot of the stuff that EpSA needs in their AD but it is hidden as "memberOf" or inside different domains. For instance quite a lot of sites put staff into one domain and students into another. If you do have these sorts of distinctions your best bet is to describe them here and someone will be able to come up with a suggestion (or better still an example XML file) to help you.
If you find EpE you will need to get more cunning, but the basic rule is the same.
1) Work out what it is that defines that a user needs this or not
2) Work out how it is stored in the AD
3) If it isn't you need to go elsewhere
4)
In case it helps, here is a template resolver file. It has a very simplistic approach to EpSA (if you can log in you are a member and thats all I can say), but it has some example code of how to exploit AD groups to be smarter. You don't have to use it, and indeed I would prefer that you think of it as guidance, but if you are like me an example file can help a lot (and you are alreadying using the arp from the same source :-)
Nigel,
> We already had the SQL database as it was our existing meta-directory
> and is used to populate our AD
FWIW it is suprising easy (I was very pleasantly suprised) to connect to SQLServer and suck out attributes....
Rod
_________________________________________________________________
You might be interested in this...
RM ICT Tour 2009
With all the pressures placed on teaching staff today, it's increasingly difficult to
justify a full day out to research developments for the classroom. So you don't
miss out, we've teamed up with schools and local authorities to bring the latest
in ICT to a venue near you.
Visit http://www.rm.com/bus for more information and a full list of venues.
_________________________________________________________________
P.S. Think Green - don't print this email unless you really need to.
This message is confidential, so please treat it appropriately and for its intended purpose only. In particular, if it refers to any technical data, terms or prices not generally available or known, such items are "commercially sensitive information" within the terms of the Freedom of Information Act 2000 and related laws. As it would be prejudicial to RM's commercial interests if these were disclosed, please refrain from doing so.
As Internet communications are not secure, please be aware that RM cannot accept responsibility for its contents. Any views or opinions presented are those of the author only and not of RM. If you are not the intended recipient of this e-mail, please accept our apologies and arrange for copies of it to be deleted. For your information, RM may intercept incoming and outgoing email communications.
RM Education plc
Registered Office: New Mill House, 183 Milton Park, Abingdon, Oxfordshire, OX14 4SE, England
Registered Number: 1148594
|