Hi,

We have a requirement to get a list of all AD groups a user is member of, including transitive/nested group memberships. We would then like to filter these groups and put them in a token, or just make them available via the /userinfo endpoint. We have a setup where we work with basic users that are present in a federated AD. 

What works well
I have successfully been able to get the groups that are present as 'memberOf' attribute in AD by configuring the following in the proxy configuration:

[TAM_CRED_ATTRS_SVC:eperson]
emailAddress = mail
mobileNumber = mobile
group = memberOf​

Then the memberOf multi valued list is present in the STSUU and can easily be added to the ID token, as explained here: https://www.ibm.com/support/pages/fine-tuning-id-tokens-isam-advanced-access-control-oidc-flows . A similar setup can be created for the access token or the /userinfo endpoint. However, this does not contain nested groups, so on to the next try. 

What does not yet seem to work
Our AD expert told us to use the 'tokenGroups' attribute, which is some kind of precalculated attribute containing ALL groups, including groups that are not linked directly to the user (meaning also transitive / nested groups). Fetching this information should be amazingly fast, since it is precalculated. This attribute is explained here: https://docs.microsoft.com/en-us/windows/win32/adschema/a-tokengroups . 

So I changed the proxy config to the following:

[TAM_CRED_ATTRS_SVC:eperson]
emailAddress = mail
mobileNumber = mobile
#group = memberOf​
group = tokenGroups​

However, debugging the STSUU object clearly showed that these groups were not added to the STSUU. I did a packet trace on the non-SSL enabled LDAP calls between ISAM and our AD during authentication, and ISAM does fetch the tokenGroups attributes as shown in the picture below:

------------------------------
Michael
------------------------------

Hi Michael,

I expect the main reason for your issues is that "tokenGroups" is a binary attribute.

I thought that some logic had been added to ISAM to allow it to pull in binary attributes by Base64-encoding them.  I thought there was some parameter to specify which attributes were binary.... but I can't find any reference to this now I'm looking.  Maybe my memory is bad... or maybe someone else can help with this.

One other idea you might try would be to pull in the attribute within the OIDC pre-token mapping rule using the User Lookup Helper.  I found some sample code that appears to do this for the Microsoft ObjectGUID and a jpeg attribute:

var ulh = new UserLookupHelper();
// use ISAM RTE - requires bind-dn and bind-pwd in ldap.conf
ulh.init();

var u = ulh.getUser(principalName);
if (u != null) {
// this should be Baes64 string
var guidValB64 = u.getAttribute("objectGUID");
var jpegPhotoB64 = u.getAttribute("jpegPhoto");

// add the b64-encoded bytes of this binary attribute to the credential
var testAttr = new Attribute("ImmutableID","", guidValB64);
stsuu.addAttribute(testAttr);
var testAttr2 = new Attribute("jpegPhoto","", jpegPhotoB64);
stsuu.addAttribute(testAttr2);
}

I can't promise but perhaps something like this work work for the tokenGroups attribute?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Michael (again),

Typical, just after I sent this I found what I was looking for.  It looks like you can specify a binary attribute in the tag_value configuration by simply appending ;binary to it:

[TAM_CRED_ATTRS_SVC:eperson]
emailAddress = mail
mobileNumber = mobile
#group = memberOf​
group = tokenGroups​;binary

Let us know if it helps.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Original Message:
Sent: Fri December 27, 2019 12:59 PM
From: Jon Harry
Subject: tokenGroups attribute for basic users

Hi Michael,

I expect the main reason for your issues is that "tokenGroups" is a binary attribute.

I thought that some logic had been added to ISAM to allow it to pull in binary attributes by Base64-encoding them.  I thought there was some parameter to specify which attributes were binary.... but I can't find any reference to this now I'm looking.  Maybe my memory is bad... or maybe someone else can help with this.

One other idea you might try would be to pull in the attribute within the OIDC pre-token mapping rule using the User Lookup Helper.  I found some sample code that appears to do this for the Microsoft ObjectGUID and a jpeg attribute:

var ulh = new UserLookupHelper();
// use ISAM RTE - requires bind-dn and bind-pwd in ldap.conf
ulh.init();

var u = ulh.getUser(principalName);
if (u != null) {
// this should be Baes64 string
var guidValB64 = u.getAttribute("objectGUID");
var jpegPhotoB64 = u.getAttribute("jpegPhoto");

// add the b64-encoded bytes of this binary attribute to the credential
var testAttr = new Attribute("ImmutableID","", guidValB64);
stsuu.addAttribute(testAttr);
var testAttr2 = new Attribute("jpegPhoto","", jpegPhotoB64);
stsuu.addAttribute(testAttr2);
}

I can't promise but perhaps something like this work work for the tokenGroups attribute?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

----edit----
It seems something changed in the connection between ISAM and AD since last week. A packet trace reveals that the tokenGroups are not being returned anymore. Therefore it is possible that 'binary-base64-attr' still is a solution. I hope to test it as soon as I get feedback from an AD expert. 
----end of edit----

Hi Jon,

Thanks for your reply. 
Your answer led me to search further using additional terms such as binary, and I stumbled upon this thread: https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread?MessageKey=60e982d4-82b6-498a-8875-700fcd223ce8&CommunityKey=e7c36119-46d7-42f2-97a9-b44f0cc89c6d&tab=digestviewer 

The second reply suggests to add the following to ldap.conf:
binary-base64-attr = objectGUID
after which you can simply use the attribute by adding it to the webseal conf:
immutableid = objectGUID

After testing this using the mobile-demo/diag tool, the objectGUID is indeed added to the attributes list, base64 encoded:
immutableid[0]         VzS[...]8A==

Trying the same with binary-base64-attr = tokenGroups (ldap.conf) and tokenGroups = tokenGroups​ (webseal conf) does not add the tokenGroups to the attributes list though. So I'm still under the impression that ISAM is throwing out the attribute since it cannot be matched to an expected attribute (perhaps ISAM tries to map it on a certain object class?). 

Kr,
Michael

------------------------------
Michael
------------------------------

Original Message:
Sent: Fri December 27, 2019 01:14 PM
From: Jon Harry
Subject: tokenGroups attribute for basic users

Hi Michael (again),

Typical, just after I sent this I found what I was looking for.  It looks like you can specify a binary attribute in the tag_value configuration by simply appending ;binary to it:

[TAM_CRED_ATTRS_SVC:eperson]
emailAddress = mail
mobileNumber = mobile
#group = memberOf​
group = tokenGroups​;binary

Let us know if it helps.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------


Original Message:
Sent: Fri December 27, 2019 12:59 PM
From: Jon Harry
Subject: tokenGroups attribute for basic users

Hi Michael,

I expect the main reason for your issues is that "tokenGroups" is a binary attribute.

I thought that some logic had been added to ISAM to allow it to pull in binary attributes by Base64-encoding them.  I thought there was some parameter to specify which attributes were binary.... but I can't find any reference to this now I'm looking.  Maybe my memory is bad... or maybe someone else can help with this.

One other idea you might try would be to pull in the attribute within the OIDC pre-token mapping rule using the User Lookup Helper.  I found some sample code that appears to do this for the Microsoft ObjectGUID and a jpeg attribute:

var ulh = new UserLookupHelper();
// use ISAM RTE - requires bind-dn and bind-pwd in ldap.conf
ulh.init();

var u = ulh.getUser(principalName);
if (u != null) {
// this should be Baes64 string
var guidValB64 = u.getAttribute("objectGUID");
var jpegPhotoB64 = u.getAttribute("jpegPhoto");

// add the b64-encoded bytes of this binary attribute to the credential
var testAttr = new Attribute("ImmutableID","", guidValB64);
stsuu.addAttribute(testAttr);
var testAttr2 = new Attribute("jpegPhoto","", jpegPhotoB64);
stsuu.addAttribute(testAttr2);
}

I can't promise but perhaps something like this work work for the tokenGroups attribute?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM

Hi Michael,

I can't explain why the binary support works for the objectGUID  attribute but not for the tokenGroups attribute.  My only suggestion now is that you raise a support ticket so that someone can investigate properly (might need some tracing and a look into the code).

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Original Message:
Sent: Mon December 30, 2019 04:00 AM
From: Michael Boey*****
Subject: tokenGroups attribute for basic users

----edit----
It seems something changed in the connection between ISAM and AD since last week. A packet trace reveals that the tokenGroups are not being returned anymore. Therefore it is possible that 'binary-base64-attr' still is a solution. I hope to test it as soon as I get feedback from an AD expert. 
----end of edit----

Hi Jon,

Thanks for your reply. 
Your answer led me to search further using additional terms such as binary, and I stumbled upon this thread: https://community.ibm.com/community/user/security/communities/community-home/digestviewer/viewthread?MessageKey=60e982d4-82b6-498a-8875-700fcd223ce8&CommunityKey=e7c36119-46d7-42f2-97a9-b44f0cc89c6d&tab=digestviewer 

The second reply suggests to add the following to ldap.conf:
binary-base64-attr = objectGUID
after which you can simply use the attribute by adding it to the webseal conf:
immutableid = objectGUID

After testing this using the mobile-demo/diag tool, the objectGUID is indeed added to the attributes list, base64 encoded:
immutableid[0]         VzS[...]8A==

Trying the same with binary-base64-attr = tokenGroups (ldap.conf) and tokenGroups = tokenGroups​ (webseal conf) does not add the tokenGroups to the attributes list though. So I'm still under the impression that ISAM is throwing out the attribute since it cannot be matched to an expected attribute (perhaps ISAM tries to map it on a certain object class?). 

Kr,
Michael

------------------------------
Michael
------------------------------


Original Message:
Sent: Fri December 27, 2019 01:14 PM
From: Jon Harry
Subject: tokenGroups attribute for basic users

Hi Michael (again),

Typical, just after I sent this I found what I was looking for.  It looks like you can specify a binary attribute in the tag_value configuration by simply appending ;binary to it:

[TAM_CRED_ATTRS_SVC:eperson]
emailAddress = mail
mobileNumber = mobile
#group = memberOf​
group = tokenGroups​;binary

Let us know if it helps.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM


Original Message:
Sent: Fri December 27, 2019 12:59 PM
From: Jon Harry
Subject: tokenGroups attribute for basic users

Hi Michael,

I expect the main reason for your issues is that "tokenGroups" is a binary attribute.

I thought that some logic had been added to ISAM to allow it to pull in binary attributes by Base64-encoding them.  I thought there was some parameter to specify which attributes were binary.... but I can't find any reference to this now I'm looking.  Maybe my memory is bad... or maybe someone else can help with this.

One other idea you might try would be to pull in the attribute within the OIDC pre-token mapping rule using the User Lookup Helper.  I found some sample code that appears to do this for the Microsoft ObjectGUID and a jpeg attribute:

var ulh = new UserLookupHelper();
// use ISAM RTE - requires bind-dn and bind-pwd in ldap.conf
ulh.init();

var u = ulh.getUser(principalName);
if (u != null) {
// this should be Baes64 string
var guidValB64 = u.getAttribute("objectGUID");
var jpegPhotoB64 = u.getAttribute("jpegPhoto");

// add the b64-encoded bytes of this binary attribute to the credential
var testAttr = new Attribute("ImmutableID","", guidValB64);
stsuu.addAttribute(testAttr);
var testAttr2 = new Attribute("jpegPhoto","", jpegPhotoB64);
stsuu.addAttribute(testAttr2);
}

I can't promise but perhaps something like this work work for the tokenGroups attribute?

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM