Configuring Shibboleth Identity Provider SAML Attributes

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Navigate to the <install_folder>/conf/ldap.properties file.
Depending on the User Mapping settings in Jamf Pro, LDAP should return the following attributes: memberOf, SamAccountName, or UserPrincipalName.
Example:
```
idp.attribute.resolver.LDAP.returnAttributes    = displayName,mail,SamAccountName,memberOf,UserPrincipalName
```

Update your attribute-resolver-ldap.xml file. The current configuration could be verified in <install_folder>/config/services.properties.

Define an LDAP data connector.

The default connector is defined in <install_folder>/conf/attribute-resolver-ldap.xml.

Example:

 <!-- ========================================== -->
    <!--      Data Connectors                       -->
    <!-- ========================================== -->


    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}" 
        principal="%{idp.attribute.resolver.LDAP.bindDN}"
        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:false}">
        <dc:FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
        <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
            <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
        </dc:StartTLSTrustCredential>
    </resolver:DataConnector>

Add a new group attribute.

Example:

<resolver:AttributeDefinition xsi:type="ad:Simple" id="group" sourceAttributeID="memberOf">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="http://schemas.xmlsoap.org/claims/Group" friendlyName="group" encodeType="false" />
    </resolver:AttributeDefinition>

Configure SAML attributes for User Mapping.
If Jamf Pro maps users by NameID, configure the NameID attribute.

If the Jamf Pro User Mapping settings are set to Username, set the uid attribute source to sAMAccountName.

Example:

<resolver:AttributeDefinition id="uid" xsi:type="ad:Simple" sourceAttributeID="sAMAccountName">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" />
</resolver:AttributeDefinition>

If the Jamf Pro User Mapping settings are set to Email, set uid attribute source to mail or UserPrincipalName. If LDAP is configured in Jamf Pro, the uid source must be set to the same LDAP attribute as the user attribute mapped in Jamf Pro.

Example:

<resolver:AttributeDefinition id="uid" xsi:type="ad:Simple" sourceAttributeID="mail">
        <resolver:Dependency ref="myLDAP" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" />
</resolver:AttributeDefinition>

If using a custom attribute in Jamf Pro, then add the appropriate attribute to the attribute-resolver-ldap.xml file.
By default, Shibboleth provides attributes which you can use.