Versions Compared

Old Version 2

changes.mady.by.user Peter Brand

Saved on

compared with

New Version 3

changes.mady.by.user Peter Brand

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: amend LDAP DC attrs

...

Codeblock
languagehtml/xml
titleLDAP DataConnector
<DataConnector id="myLDAP" xsi:type="LDAPDirectory"
    ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
    baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
    principal="%{idp.attribute.resolver.LDAP.bindDN}"
    principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
    useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
    startTLSTimeout="%{idp.attribute.resolver.LDAP.startTLSTimeout}"
    connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
    trustFile="%{idp.attribute.resolver.LDAP.trustCertificates}"
    responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}"
    connectionStrategy="%{idp.attribute.resolver.LDAP.connectionStrategy}"
    noResultIsError="true"
    multipleResultsIsError="true"
    excludeResolutionPhases="c14n/attribute">
    <FilterTemplate>
        <![CDATA[
            %{idp.attribute.resolver.LDAP.searchFilter}
        ]]>
    </FilterTemplate>
    <ConnectionPool
        minPoolSize="%{idp.pool.LDAP.minSize:3}"
        maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
        blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
        validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
        validateTimerPeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"
        validateDN="%{idp.pool.LDAP.validateDN:}"
        validateOnCheckout="%{idp.pool.LDAP.validateOnCheckout:false}"
        validateFilter="%{idp.pool.LDAP.validateFilter:(objectClass=*)}"
        prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
        expirationTime="%{idp.pool.LDAP.idleTime:PT10M}"/>
</DataConnector>

If you're done with editing activate the changes by restarting Tomcat – assuming you've changed some Java property files (such as saml-nameid.properties) which are only read on at JVM startup of the JVM:

Kein Format
systemctl restart tomcat9tomcat10

At any later point, once the IDP has all the properties set, you should activate resolver changes in a running IDP by reload reloading only the IDP's attribute resolver sub-system (not by restarting the IDP or Tomcat):

...