attribute-resolver.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
    This file is an EXAMPLE configuration file containing lots of commented
    example attributes, encoders, and a couple of example data connectors.
     
    Not all attribute definitions or data connectors are demonstrated, but
    a variety of LDAP attributes, some common to Shibboleth deployments and
    many not, are included.
    
    Deployers should refer to the Identity Provider 3 documentation
    
    https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration
     
    for a complete list of components and their options.
-->
<AttributeResolver
        xmlns="urn:mace:shibboleth:2.0:resolver"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd">

    <!-- ========================================== -->
    <!--      Attribute Definitions                 -->
    <!-- ========================================== -->

    <!-- Schema: Core schema attributes-->
    <AttributeDefinition xsi:type="Simple" id="uid">
        <InputDataConnector ref="myLDAP" attributeNames="uid"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="mail">
        <InputDataConnector ref="myLDAP" attributeNames="mail"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="homePhone">
        <InputDataConnector ref="myLDAP" attributeNames="homePhone"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="homePostalAddress">
        <InputDataConnector ref="myLDAP" attributeNames="homePostalAddress"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="mobileNumber">
        <InputDataConnector ref="myLDAP" attributeNames="mobile"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="pagerNumber">
        <InputDataConnector ref="myLDAP" attributeNames="pager"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="surname">
        <InputDataConnector ref="myLDAP" attributeNames="sn"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="locality">
        <InputDataConnector ref="myLDAP" attributeNames="l"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="stateProvince">
        <InputDataConnector ref="myLDAP" attributeNames="st"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="street">
        <InputDataConnector ref="myLDAP" attributeNames="street"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="organizationName">
        <InputDataConnector ref="myLDAP" attributeNames="o"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="organizationalUnit">
        <InputDataConnector ref="myLDAP" attributeNames="ou"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="title">
        <InputDataConnector ref="myLDAP" attributeNames="title"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="postalAddress">
        <InputDataConnector ref="myLDAP" attributeNames="postalAddress"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="postalCode">
        <InputDataConnector ref="myLDAP" attributeNames="postalCode"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="postOfficeBox">
        <InputDataConnector ref="myLDAP" attributeNames="postOfficeBox"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="telephoneNumber">
        <InputDataConnector ref="myLDAP" attributeNames="telephoneNumber"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="givenName">
        <InputDataConnector ref="myLDAP" attributeNames="givenName"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="initials">
        <InputDataConnector ref="myLDAP" attributeNames="initials"/>
    </AttributeDefinition>

    <!-- Schema: inetOrgPerson attributes-->
    <AttributeDefinition xsi:type="Simple" id="departmentNumber">
        <InputDataConnector ref="myLDAP" attributeNames="departmentNumber"/>
    </AttributeDefinition>
    
    <AttributeDefinition xsi:type="Simple" id="displayName">
        <InputDataConnector ref="myLDAP" attributeNames="displayName"/>
    </AttributeDefinition> 

    <AttributeDefinition xsi:type="Simple" id="employeeNumber">
        <InputDataConnector ref="myLDAP" attributeNames="employeeNumber"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="employeeType">
        <InputDataConnector ref="myLDAP" attributeNames="employeeType"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="jpegPhoto">
        <InputDataConnector ref="myLDAP" attributeNames="jpegPhoto"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="preferredLanguage">
        <InputDataConnector ref="myLDAP" attributeNames="preferredLanguage"/>
    </AttributeDefinition>

    <!-- Schema: eduPerson attributes -->
    <AttributeDefinition xsi:type="Simple" id="eduPersonAffiliation">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonAffiliation" />
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="eduPersonEntitlement">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonEntitlement"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="eduPersonNickname">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonNickname"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="eduPersonPrimaryAffiliation">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonPrimaryAffiliation"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Prescoped" id="eduPersonPrincipalName">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonPrincipalName"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Prescoped" id="eduPersonPrincipalNamePrior">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonPrincipalNamePrior"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Scoped" id="eduPersonScopedAffiliation" scope="%{idp.scope}">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonAffiliation"/>
    </AttributeDefinition>
    
    <AttributeDefinition xsi:type="Simple" id="eduPersonAssurance">
        <InputDataConnector ref="myLDAP" attributeNames="eduPersonAssurance"/>
    </AttributeDefinition>

    <!-- Semi-deprecated eduPersonUniqueId, should be phased out in favor of SAML subject-id replacement below. -->
<!-- 
    <AttributeDefinition xsi:type="Scoped" id="eduPersonUniqueId" scope="%{idp.scope}">
        <InputDataConnector ref="myLDAP" attributeNames="%{idp.persistentId.sourceAttribute}"/>
    </AttributeDefinition>
-->

    <!-- Schema: SAML Subject ID Attributes -->
<!--
    <AttributeDefinition xsi:type="Scoped" id="samlSubjectID" scope="%{idp.scope}">
        <InputDataConnector ref="myLDAP" attributeNames="%{idp.persistentId.sourceAttribute}"/>
    </AttributeDefinition>

    <AttributeDefinition xsi:type="Scoped" id="samlPairwiseID" scope="%{idp.scope}">
        <InputDataConnector ref="computed" attributeNames="computedId"/>
    </AttributeDefinition>
-->

    <!-- ========================================== -->
    <!--      Data Connectors                       -->
    <!-- ========================================== -->

    <!-- Example Static Connector -->

    <!-- Example Relational Database Connector.  
         In practice a <SimpleManagedConnection> is enough to get you going but you should consider a
         <BeanManagedConnection> fully configured for your particular environment -->
    
<!--
    <DataConnector id="mySIS" xsi:type="RelationalDatabase">
        <SimpleManagedConnection jdbcDriver="oracle.jdbc.driver.OracleDriver"
                                 jdbcURL="jdbc:oracle:thin:@db.example.org:1521:SomeDB" 
                                 jdbcUserName="myid" 
                                 jdbcPassword="mypassword" />
        <QueryTemplate>
            <![CDATA[
                SELECT * FROM student WHERE gzbtpid = '$resolutionContext.principal'
            ]]>
        </QueryTemplate>

        <Column columnName="gzbtpid" attributeID="uid" />
        <Column columnName="fqlft" attributeID="gpa" />
    </DataConnector>
-->

    <!-- Example LDAP Connector -->
    <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
        connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
        responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </FilterTemplate>
	    <ConnectionPool
            minPoolSize="%{idp.pool.LDAP.minSize:3}"
            maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
            blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
            validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
            validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
            expirationTime="%{idp.pool.LDAP.idleTime:PT10M}" />
    </DataConnector>

    <!-- DataConector for pairwise-id (example depends on saml-nameid.properties). -->

<!-- 
    <DataConnector id="computed" xsi:type="ComputedId"
	    generatedAttributeID="computedId"
	    salt="%{idp.persistentId.salt}"
	    algorithm="%{idp.persistentId.algorithm:SHA}"
        encoding="%{idp.persistentId.encoding:BASE32}">
	    
        <InputDataConnector ref="myLDAP" attributeNames="%{idp.persistentId.sourceAttribute}" />
        
	</DataConnector>
-->

</AttributeResolver>