 |
 |
Paul, You want to look at "resolvertest". It should be in the bin directory of your IdP installation. This basically fires up all the bits of an IDP. If you tun on verbose debugging you will see the attributes being pulled from the LDAP. > Does shibboleth create Opaque string value or can I use something like SID > from active directory for this attribute Shibboleth takes care of that. What you have to give it is an identifier which uniquely identifies the user on this IdP and which will not be reused within (I think) about 6 months. SIDs are ideal for that. Rod ----- Original Message ----- From: "Paul Cheyne" <[log in to unmask]> To: <[log in to unmask]> Sent: Wednesday, May 06, 2009 2:42 PM Subject: Re: Attribute Definitions and metadatatool Afternoon all I have put together a resolver.xml document which I would like to test. Is there a tool out there that allows me to query the directory to see if the attributes are mapping correctly. Also I have a question on eduPersonTargetID. Does shibboleth create Opaque string value or can I use something like SID from active directory for this attribute Paul Cheyne Support Consultant RM (Aberdeen College) Tel: 01224 (61)2550 Email: [log in to unmask] -----Original Message----- From: Discussion list for Shibboleth developments [mailto:[log in to unmask]] On Behalf Of Peter Schober Sent: 06 May 2009 10:40 To: [log in to unmask] Subject: Re: Attribute Definitions and metadatatool * Lowry, Francis <[log in to unmask]> [2009-05-06 10:55]: > Following on from Mike's response, there are additional options for > sourcing the different attributes. We use a combination of Active > Directory for the eduPrincipalName, a salt for the eduPersonTargetID, > and a JDBC lookup to a SQL Server database for the affiliations and > entitlements. > > This allows us to separate the management of entitlements which is a > library function in our organsation from the AD management, on the basis > that is is easier for us to maintain contents of database tables rather > than add extra processing to maintain AD. Just remember that depending on many data sources makes it harder to achieve high(er) availability, if the need comes up. Sync'ing the data to a single source (if management in one data source is not possible) might provide for better resiliance (at other costs, of course). E.g. in case you also use Shibboleth as your campus WebSSO system you probably want to reduce the possibility of large parts of the campus web becoming unavailable (for new sessions) because of an IdP-related problem. Since Shib always talks to all data sources configured, that extends the need for higher availablility to all storage engines (databases, directories, etc.) upon the IdP depends for it's operation. Each of which usually is both expensive and difficult to get to a redundant, clustered mode of operation with realiable fail-over and recovery, etc. Cheers, -peter _________________________________________________________________ You might be interested in this... RM ICT Tour 2009 With all the pressures placed on teaching staff today, it's increasingly difficult to justify a full day out to research developments for the classroom. So you don't miss out, we've teamed up with schools and local authorities to bring the latest in ICT to a venue near you. Visit http://www.rm.com/bus for more information and a full list of venues. _________________________________________________________________ P.S. Think Green - don't print this email unless you really need to. This message is confidential, so please treat it appropriately and for its intended purpose only. In particular, if it refers to any technical data, terms or prices not generally available or known, such items are "commercially sensitive information" within the terms of the Freedom of Information Act 2000 and related laws. As it would be prejudicial to RM's commercial interests if these were disclosed, please refrain from doing so. As Internet communications are not secure, please be aware that RM cannot accept responsibility for its contents. Any views or opinions presented are those of the author only and not of RM. If you are not the intended recipient of this e-mail, please accept our apologies and arrange for copies of it to be deleted. For your information, RM may intercept incoming and outgoing email communications. RM Education plc Registered Office: New Mill House, 183 Milton Park, Abingdon, Oxfordshire, OX14 4SE, England Registered Number: 1148594