Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Exposing Groups Through Shibboleth

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Exposing Groups Through Shibboleth

Chronological Thread 
  • From: Jim Fox <>
  • To: Mark Cairney <>
  • Cc:
  • Subject: Re: [grouper-users] Exposing Groups Through Shibboleth
  • Date: Tue, 22 Nov 2011 08:47:42 -0800 (PST)

We also use groups to compute entitlements, and we send group memberships directly as well. The resolver for group memberships has two encoders:

<resolver:AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:isMemberOf" />

<resolver:AttributeEncoder xsi:type="SAML2String"
friendlyName="isMemberOf" />

and the computation uses a Template to add our namespace preface
to each of the group names:



On Tue, 22 Nov 2011, Mark Cairney wrote:

Date: Tue, 22 Nov 2011 06:57:42 -0800
From: Mark Cairney

Subject: Re: [grouper-users] Exposing Groups Through Shibboleth


I recently did something fairly similar to this in our TEST environment based
on option 1.

The process is largely described in the Grouper document listed but as I
wanted to use LDAP groups created by the Grouper provisioner to
create entitlements in Shibboleth the "additional" steps were:

In my attribute-resolver.xml file in /opt/shibboleth-idp:

1. Turn eduPersonEntitlement into a scripted attribute:

<resolver:AttributeDefinition id="eduPersonEntitlement" xsi:type="Script"
<resolver:Dependency ref="AuthLDAP" />

2. Write a small script that adds an eduPersonEntitlement string when the
user is in a matching group. This is done with a short bit of JavaScript
which I gleaned off the SWITCH documentation IIRC.

<resolver:AttributeEncoder xsi:type="SAML1String"
name="urn:mace:dir:attribute-def:eduPersonEntitlement" />

<resolver:AttributeEncoder xsi:type="SAML2String"
friendlyName="eduPersonEntitlement" />


// Create attribute to be returned from definition
if (eduPersonEntitlement == null) eduPersonEntitlement = new

// If the user has group membership
if (typeof memberOf != "undefined" && memberOf != null ){
// Then go through each group membership and add the appropriate
// The IdP will remove duplicate values so we don't need to worry
about that here
for ( i = 0; memberOf != null && i < memberOf.getValues().size();
i++ ){
value = memberOf.getValues().get(i);

if (value.contains("cn=test,ou=adhoc,ou=adhoc,ou=grouper")){




3. Add "memberOf" to the ReturnedAttributes list for the LDAP data connector:

<ReturnAttributes>uid eduPersonAffiliation eduPersonEntitlement mail givenName sn
cn memberOf</ReturnAttributes>

I'm using OpenLDAP with the slapo-memberOf overlay as my LDAP data source-
this puts the user's group memberships into the memberOf operational
attribute automagically as they are added/removed by Grouper.

Hope this is useful,


On 21 Nov 2011, at 21:13, Klug, Lawrence wrote:


Thanks a lot!



On Behalf Of Tom Barton
Sent: Monday, November 21, 2011 12:08 PM

Subject: Re: [grouper-users] Exposing Groups Through Shibboleth

To expand a little on David's answer,


suggests config on the shib IdP to pull group info out of LDAP.

Your question might also have been motivated by


because Ldappcng uses the shib attribute resolver and so similar looking
config resides in ldappc-resolver.xml.

Just to air things out a bit further, I'll note that there's also


which addresses the same needs first addressed by item 1, but using one or
both of two new DataConnectors available to the shib IdP that provide group
and membership info from grouper directly to the IdP.


On 11/21/2011 1:40 PM, David Langenberg wrote:
Looking @ the doc. All the examples with '<resolver:' type XML are in
attribute-resolver.xml. The rest are attribute-filter.xml.


David Langenberg
Identity Management
The University of Chicago

From: "Klug, Lawrence"
Date: Mon, 21 Nov 2011 13:31:50 -0600

Subject: [grouper-users] Exposing Groups Through Shibboleth

Looking at this admin guide:

Question: Is this example configured on the Grouper side or the Shibboleth
side? What config file is shown in the code examples?

Our use case: Configure Shibboleth and Grouper to manage groups in Plone.
(Plone is a Zope-based open source CMS product).



Lawrence Klug
UCLA Middleware Services
Office: 310 825-2061
Cell: 818 667-2386

Mark Cairney
ITI UNIX Section
Information Services
University of Edinburgh

Tel: 0131 650 6565


The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.

Archive powered by MHonArc 2.6.16.

Top of Page