Shibboleth Developers

[Jim Fox <>]

> > However, I've misconfigured something, and the role/authZ stuff isn't
> > working.
>
> What are you trying to do with it? I wouldn't advise using it at all unless
> you have to.
>
> > I wanted to retrieve eduPersonAffiliation from ldap, and have that
> > mapped to a tomcat role value...
>
> I don't think it works like that, but I have no idea. You definitely have to
> provide the role class name in the Tomcat Realm configuration though.

Starting with about tomcat 5.5.15 the ldap authenticator requires
an actual ldap attribute as a role.  An easy one is something like

  objectClass: inetOrgPerson

or something like that: an attribute that everyone has.

eduPersonAffiliation would work, as long as everyone has a good one.

Jim