Paul,

You want to look at "resolvertest".  It should be in the bin directory of 
your IdP installation.  This basically fires up all the bits of an IDP.  If 
you tun on verbose debugging you will see the attributes being pulled from 
the LDAP.

> Does shibboleth create Opaque string value or can I use something like SID 
> from active directory for this attribute

Shibboleth takes care of that.  What you have to give it is an identifier 
which uniquely identifies the user on this IdP and which will not be reused 
within (I think) about 6 months.  SIDs are ideal for that.

Rod


----- Original Message ----- 
From: "Paul Cheyne" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Wednesday, May 06, 2009 2:42 PM
Subject: Re: Attribute Definitions and metadatatool


Afternoon all

I have put together a resolver.xml document which I would like to test.  Is 
there a tool out there that allows me to query the directory to see if the 
attributes are mapping correctly.  Also I have a question on 
eduPersonTargetID.  Does shibboleth create Opaque string value or can I use 
something like SID from active directory for this attribute

Paul Cheyne
Support Consultant
RM (Aberdeen College)
Tel:  01224 (61)2550
Email:  [log in to unmask]



-----Original Message-----
From: Discussion list for Shibboleth developments 
[mailto:[log in to unmask]] On Behalf Of Peter Schober
Sent: 06 May 2009 10:40
To: [log in to unmask]
Subject: Re: Attribute Definitions and metadatatool

* Lowry, Francis <[log in to unmask]> [2009-05-06 10:55]:
> Following on from Mike's response, there are additional options for
> sourcing the different attributes. We use a combination of Active
> Directory for the eduPrincipalName, a salt for the eduPersonTargetID,
> and a JDBC lookup to a SQL Server database for the affiliations and
> entitlements.
>
> This allows us to separate the management of entitlements which is a
> library function in our organsation from the AD management, on the basis
> that is is easier for us to maintain contents of database tables rather
> than add extra processing to maintain AD.

Just remember that depending on many data sources makes it harder to
achieve high(er) availability, if the need comes up. Sync'ing the data
to a single source (if management in one data source is not possible)
might provide for better resiliance (at other costs, of course).

E.g. in case you also use Shibboleth as your campus WebSSO system you
probably want to reduce the possibility of large parts of the campus
web becoming unavailable (for new sessions) because of an IdP-related
problem. Since Shib always talks to all data sources configured, that
extends the need for higher availablility to all storage engines
(databases, directories, etc.) upon the IdP depends for it's
operation. Each of which usually is both expensive and difficult to
get to a redundant, clustered mode of operation with realiable
fail-over and recovery, etc.

Cheers,
-peter
_________________________________________________________________

You might be interested in this...

RM ICT Tour 2009
With all the pressures placed on teaching staff today, it's increasingly 
difficult to
justify a full day out to research developments for the classroom. So you 
don't
miss out, we've teamed up with schools and local authorities to bring the 
latest
in ICT to a venue near you.

Visit http://www.rm.com/bus for more information and a full list of venues.

_________________________________________________________________

P.S. Think Green - don't print this email unless you really need to.
This message is confidential, so please treat it appropriately and for its 
intended purpose only.  In particular, if it refers to any technical data, 
terms or prices not generally available or known, such items are 
"commercially sensitive information" within the terms of the Freedom of 
Information Act 2000 and related laws.  As it would be prejudicial to RM's 
commercial interests if these were disclosed, please refrain from doing so.



As Internet communications are not secure, please be aware that RM cannot 
accept responsibility for its contents.  Any views or opinions presented are 
those of the author only and not of RM.  If you are not the intended 
recipient of this e-mail, please accept our apologies and arrange for copies 
of it to be deleted.  For your information, RM may intercept incoming and 
outgoing email communications.



RM Education plc
Registered Office: New Mill House, 183 Milton Park, Abingdon, Oxfordshire, 
OX14 4SE, England
Registered Number: 1148594