[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[upki-fed:153] Re: Active Directory 上の eduPerson 属性について
- Subject: [upki-fed:153] Re: Active Directory 上の eduPerson 属性について
- Date: Thu, 4 Feb 2010 16:23:31 +0900 (JST)
- From: "kaz igarashi" <xxx@xxxxxxxxxxx>
山地先生
成城大学五十嵐です．
ありがとうございました．
edu.internet2.middleware.shibboleth Logger のレベルが INFO だった
ので，DEBUG にあげたら確認できました．
結局，
----------------------------------------------------------------
16:04:00.726 - TRACE [edu.vt.middleware.ldap.Ldap:582] - config =
{java.naming.provider.url=ldap://mncssotad.seijo.ac.jp:3268,
java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}
16:04:00.728 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: uSNChanged=[33134]
16:04:00.728 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: mail=[xxx@xxxxxxxxxxx]
16:04:00.729 - DEBUG [edu.internet2.middleware.shibboleth.common.attribute.r
esolver.provider.dataConnector.LdapDataConnector:882] - Found the following
attribute: sn=[五十嵐]
16:04:00.729 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: objectSid=[���w
�%Ny�^]
16:04:00.729 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: whenCreated=[20100204033850.0Z]
16:04:00.732 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: userAccountControl=[66176]
16:04:00.732 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: uSNCreated=[33124]
16:04:00.732 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: objectClass=[top, person,
organizationalPerson, user]
16:04:00.732 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute:
memberOf=[CN=mncstaff,OU=mnc,DC=ssotest,DC=seijo,DC=ac,DC=jp]
16:04:00.733 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: sAMAccountType=[805306368]
16:04:00.733 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: instanceType=[4]
16:04:00.734 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute:
userPrincipalName=[xxx@xxxxxxxxxxxxxxxxxxx]
16:04:00.734 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: whenChanged=[20100204040110.0Z]
16:04:00.735 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: cn=[kaz]
16:04:00.735 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: sAMAccountName=[kaz]
16:04:00.735 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: primaryGroupID=[513]
16:04:00.735 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: description=[member]
16:04:00.735 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: name=[kaz]
16:04:00.735 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute:
objectCategory=[CN=Person,CN=Schema,CN=Configuration,DC=ssotest,DC=seijo,DC=ac,DC=jp]
16:04:00.736 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute:
objectGUID=[]�k��C�~kt_D�]
16:04:00.736 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute: displayName=[Kazuhiro Igarashi]
16:04:00.736 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
- Found the following attribute:
distinguishedName=[CN=kaz,OU=mnc,DC=ssotest,DC=seijo,DC=ac,DC=jp]
16:04:00.737 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute eduPersonPrincipalName containing 1 values
16:04:00.737 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:285]
- Resolving attribute eduPersonAffiliation for principal kaz
16:04:00.737 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute eduPersonAffiliation containing 0 values
16:04:00.737 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:285]
- Resolving attribute email for principal kaz
16:04:00.737 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute email containing 1 values
16:04:00.737 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:285]
- Resolving attribute transientId for principal kaz
16:04:00.738 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute transientId containing 1 values
16:04:00.738 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:285]
- Resolving attribute surname for principal kaz
16:04:00.738 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute surname containing 1 values
16:04:00.738 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:285]
- Resolving attribute eduPersonEntitlement for principal kaz
16:04:00.738 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:325]
- Resolving data connector staticEntitlement for principal kaz
16:04:00.739 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute eduPersonEntitlement containing 1 values
16:04:00.739 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:285]
- Resolving attribute givenName for principal kaz
16:04:00.739 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute givenName containing 0 values
16:04:00.739 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:285]
- Resolving attribute displayName for principal kaz
16:04:00.739 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:307]
- Resolved attribute displayName containing 1 values
16:04:00.740 - DEBUG
[edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:417]
- Removing attribute eduPersonAffiliation from resolution result for
principal kaz. It contains no values.
----------------------------------------------------------------
こんな感じで，eduPersonAffiliation に値が無いと言われてしまうの
ですが，ldapsearch コマンドだと値は取得できます．
---------------------------------------------------------------
ldapsearch -x -h mncssotad.seijo.ac.jp -D Administrator@ssotest -W -b
"dc=ssotest,dc=seijo,dc=ac,dc=jp" "sAMAccountName=kaz"
...
eduPersonAffiliation: staff
...
---------------------------------------------------------------
AD の場合 Login Handler を GC に向けるのに Port 3268 を使うよう
https://spaces.internet2.edu/display/SHIB2/IdPADConfigIssues に
ありますが，利用 Port によって取得できる属性値が変わってしまう
のでしょうか？
> やまじです．
>
> ** On Thu, 4 Feb 2010 14:43:04 +0900 (JST)
> ** kaz igarashi <xxx@xxxxxxxxxxx> writes:
>
>> AttributeDefinition で sourceAttributeID に拡張スキーマ以外の属性値
>> (例えば description 等)を指定すれば test-sp に値が渡るので，LDAP の
>> DataConnector が取得した直後の値を直接確認できないかと悩んでいます．
>
> SPにアクセスした後にIdPのidp-process.logをみたときに，以下のような感じ
> で，Found the following attributeというログにその属性がでていないでし
> ょうか？
>
> 15:18:53.336 - DEBUG [edu.vt.middleware.ldap.Ldap:549] - Search with the
> following parameters:
> 15:18:53.336 - DEBUG [edu.vt.middleware.ldap.Ldap:550] - dn =
> o=test_o,dc=ac,c=JP
> 15:18:53.337 - DEBUG [edu.vt.middleware.ldap.Ldap:551] - filter =
> (uid=yamaji)
> 15:18:53.337 - DEBUG [edu.vt.middleware.ldap.Ldap:552] - filterArgs =
> 15:18:53.337 - DEBUG [edu.vt.middleware.ldap.Ldap:554] - none
> 15:18:53.337 - DEBUG [edu.vt.middleware.ldap.Ldap:558] - retAttrs =
> 15:18:53.338 - DEBUG [edu.vt.middleware.ldap.Ldap:560] - all
> attributes
> 15:18:53.338 - TRACE [edu.vt.middleware.ldap.Ldap:565] - config =
> {java.naming.provider.url=ldap://localhost:389,
> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}
> 15:18:53.363 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
> - Found the following attribute: uid=[yamaji]
> 15:18:53.364 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
> - Found the following attribute: mail=[xxxxxx@xxxxxxxxx]
> 15:18:53.364 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
> - Found the following attribute: eduPersonAffiliation=[member]
> 15:18:53.364 - DEBUG
> [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector:882]
> - Found the following attribute: sn=[yamaji]
> ひっぱってこれた属性がでます．
> --
> Kazu
>
Kaz Igarashi +++++++++++++++++++++++++++++
Mail to ------------------ xxx@xxxxxxxxxxx
URL -------------- http://www.seijo.ac.jp/
+++++++++++++++++++++++++ MNC, Seijo Univ.