idp-war-3.4.4.war in Maven Repo is bad

Fri Jun 14 19:12:23 EDT 2019

Hey Scott,

Well it looks like there is a binaryAttributes property in the
Ldaptive SDK, not in the UnboundID provider, but it's not exposed in
the IDP code so we can set it.  I did find some properties in the
ldaptive test source. I tried adding them as you can see in the logs
below, but no
luck.  Looking at the ldap ldaptive and unboundid source there is
support for binaryAttributes and derefAliases, but neither look like
you can set them using a Java System Properties.  You can see in the
log entry below that I've set
org.ldaptive.binaryAttributes=objectGUID,
org.ldaptive.connectTimeout=PT8S, org.ldaptive.derefAliases=NEVER,
which I found in the ldaptive test source.

When the IDP authentication and attribute resolution completes the
user is redirected back the SP and the SP logs show the following
ERROR...

2019-06-14 00:44:32 ERROR Shibboleth.SSO.SAML2 [3] [default]: failed
to decrypt assertion: XMLSecurity exception while decrypting: Errors
occurred during de-serialisation of decrypted element content
2019-06-14 00:44:32 WARN Shibboleth.SSO.SAML2 [3] [default]: error
processing incoming assertion: A valid authentication statement was
not found in the incoming message.

Why simply changing out the LDAP provider to use the UnboundID causes
this to happen I have no clue, but the only difference I've found in
the IDP logs is the objectGUID coming back messed up because I can't
find a way to configure the binaryAttributes property for Ldaptive.
Looking at all the code for the IDP, ldaptive, and the unboundid
provider it would seem that Shibboleth will have to make code changes
to be able to set properties that we used to be able to set using the
jndi properties, ex...binaryAttributes and derefAliases.

These are the logs showing where you can see that I set the
properties, but in the search request you can see that
binaryAttributes is still set to null, which is the default value
based on the Ldaptive source and documentation.

DEBUG [org.ldaptive.SearchOperation:138] - execute
request=[org.ldaptive.SearchRequest at -430563002::baseDn=DC=mydomain,DC=com,
searchFilter=[org.ldaptive.SearchFilter at -142096805::filter=(&(sAMAccountName=jsmith)(objectclass=user)),
parameters={}], returnAttributes=[objectGUID, sAMAccountName,
department, sn, givenName, mail, telephoneNumber],
searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null,
typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED,
searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler at -1580910376::dnAttributeName=entryDN,
addIfExists=false]], searchReferenceHandlers=null, controls=null,
followReferrals=false, intermediateResponseHandlers=null] with
connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1153421247::config=[org.ldaptive.ConnectionConfig at 1903478003::ldapUrl=ldap://ldap1:3268,
connectTimeout=3000, responseTimeout=3000,
sslConfig=[org.ldaptive.ssl.SslConfig at 1794675335::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 25db2f4f,
trustManagers=null, hostnameVerifier=null,
hostnameVerifierConfig=null, enabledCipherSuites=null,
enabledProtocols=null, handshakeCompletedListeners=null],
useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer at 1920649635::bindDn=CN=BINDUSER,OU=Users,DC=mydomain,DC=com,
bindSaslConfig=null, bindControls=null]],
providerConnectionFactory=[org.ldaptive.provider.unboundid.UnboundIDConnectionFactory at 1799602403::metadata=[ldapUrl=ldap://ldap1:3268,
count=6], providerConfig=[org.ldaptive.provider.unboundid.UnboundIDProviderConfig at 12825950::operationExceptionResultCodes=[SERVER_DOWN],
properties={org.ldaptive.binaryAttributes=objectGUID,
org.ldaptive.connectTimeout=PT8S, org.ldaptive.derefAliases=NEVER},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy at 5b5a5202,
controlProcessor=org.ldaptive.provider.ControlProcessor at 524ad520,
connectionOptions=null, socketFactory=null, sslSocketFactory=null,
searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED]]],
providerConnection=org.ldaptive.provider.unboundid.UnboundIDConnection at 25469a50]
DEBUG [org.ldaptive.provider.unboundid.UnboundIDConnection:659] -
performing search: SearchRequest(baseDN='DC=mydomain,DC=com',
scope=SUB, deref=NEVER, sizeLimit=1, timeLimit=3000,
filter='(&(sAMAccountName=jsmith)(objectclass=user))',
attrs={objectGUID, sAMAccountName, department, sn, givenName, mail,
telephoneNumber})
DEBUG [org.ldaptive.provider.unboundid.UnboundIDConnection:663] -
created response: [org.ldaptive.Response at 1169478761::result=null,
resultCode=SUCCESS, message=null, matchedDn=null,
responseControls=null, referralURLs=[], messageId=3]
DEBUG [org.ldaptive.SearchOperation:168] - execute
response=[org.ldaptive.Response at 960201973::result=[org.ldaptive.SearchResult at 1216789946::entries=[[dn=CN=jsmith,OU=Users,DC=mydomain,DC=com[[telephoneNumber[(555)
555-5555]], [mail[jsmith at mydomain.com]], [givenName[Joe]],
[objectGUID[ ï¿½ï¿½ï¿½ ï¿½Dï¿½H`ï¿½k gb]], [sn[Smith]],
[department[IT]], [entryDN[CN=jsmith,OU=Users,DC=mydomain,DC=com]],
[sAMAccountName[jsmith]]], responseControls=null, messageId=3]],
references=[]], resultCode=SUCCESS, message=null, matchedDn=null,
responseControls=null, referralURLs=[], messageId=3] for
request=[org.ldaptive.SearchRequest at -430563002::baseDn=DC=mydomain,DC=com,
searchFilter=[org.ldaptive.SearchFilter at -142096805::filter=(&(sAMAccountName=jsmith)(objectclass=user)),
parameters={}], returnAttributes=[objectGUID, sAMAccountName,
department, sn, givenName, mail, telephoneNumber],
searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null,
typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED,
searchEntryHandlers=[[org.ldaptive.handler.DnAttributeEntryHandler at -1580910376::dnAttributeName=entryDN,
addIfExists=false]], searchReferenceHandlers=null, controls=null,
followReferrals=false, intermediateResponseHandlers=null] with
connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1153421247::config=[org.ldaptive.ConnectionConfig at 1903478003::ldapUrl=ldap://ldap1:3268,
connectTimeout=3000, responseTimeout=3000,
sslConfig=[org.ldaptive.ssl.SslConfig at 1794675335::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 25db2f4f,
trustManagers=null, hostnameVerifier=null,
hostnameVerifierConfig=null, enabledCipherSuites=null,
enabledProtocols=null, handshakeCompletedListeners=null],
useSSL=false, useStartTLS=false,
connectionInitializer=[org.ldaptive.BindConnectionInitializer at 1920649635::bindDn=CN=BINDUSER,OU=Users,DC=mydomain,DC=com,
bindSaslConfig=null, bindControls=null]],
providerConnectionFactory=[org.ldaptive.provider.unboundid.UnboundIDConnectionFactory at 1799602403::metadata=[ldapUrl=ldap://ldap1:3268,
count=6], providerConfig=[org.ldaptive.provider.unboundid.UnboundIDProviderConfig at 12825950::operationExceptionResultCodes=[SERVER_DOWN],
properties={org.ldaptive.binaryAttributes=objectGUID,
org.ldaptive.connectTimeout=PT8S, org.ldaptive.derefAliases=NEVER},
connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy at 5b5a5202,
controlProcessor=org.ldaptive.provider.ControlProcessor at 524ad520,
connectionOptions=null, socketFactory=null, sslSocketFactory=null,
searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED]]],
providerConnection=org.ldaptive.provider.unboundid.UnboundIDConnection at 25469a50]

--

Thanks,

Dan McLaughlin
Technology Consortium, LLC
dmclaughlin at tech-consortium.com
mobile: 512.633.8086
http://www.tech-consortium.com

NOTICE: This e-mail message and all attachments transmitted with it
are for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is strictly prohibited. The contents of
this e-mail are confidential and may be subject to work product
privileges. If you are not the intended recipient, please contact the
sender by reply e-mail and destroy all copies of the original message.

--

Thanks,

Dan McLaughlin
Technology Consortium, LLC
dmclaughlin at tech-consortium.com
mobile: 512.633.8086
http://www.tech-consortium.com

NOTICE: This e-mail message and all attachments transmitted with it
are for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review, use,
disclosure or distribution is strictly prohibited. The contents of
this e-mail are confidential and may be subject to work product
privileges. If you are not the intended recipient, please contact the
sender by reply e-mail and destroy all copies of the original message.
On Fri, Jun 14, 2019 at 11:42 AM Dan McLaughlin
<dmclaughlin at tech-consortium.com> wrote:
>
> Hey Daniel,
>
> I've been searching the UnboundID LDAP SDK docs for a list of Java
> System Properties that I can set when using the Shibboleth IDP and I
> can't find a list in the docs anywhere. Would you mind pointing me in
> the right direction?  Specifically I need to set the equivalent of
> java.naming.ldap.derefAliases=never,
> java.naming.ldap.attributes.binary=objectGUID,
> com.sun.jndi.ldap.connect.timeout=500.
>
> --
>
> Thanks,
>
> Dan McLaughlin
> Technology Consortium, LLC
> dmclaughlin at tech-consortium.com
> mobile: 512.633.8086
> http://www.tech-consortium.com
>
> NOTICE: This e-mail message and all attachments transmitted with it
> are for the sole use of the intended recipient(s) and may contain
> confidential and privileged information. Any unauthorized review, use,
> disclosure or distribution is strictly prohibited. The contents of
> this e-mail are confidential and may be subject to work product
> privileges. If you are not the intended recipient, please contact the
> sender by reply e-mail and destroy all copies of the original message.
>
> On Fri, Jun 14, 2019 at 9:12 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
> >
> > On 6/14/19, 3:47 AM, "dev on behalf of Dan McLaughlin" <dev-bounces at shibboleth.net on behalf of dmclaughlin at tech-consortium.com> wrote:
> >
> > >  When using JNDI we set   <LDAPProperty
> > > name="java.naming.ldap.attributes.binary" value="objectGUID"/>, but
> > > that seems to be getting ignored by the UnboundID  provider.
> >
> > Yes, that's a JNDI property, it would not work with anything else. That's what the page we created about this change mentions, JNDI specific property issues that would have to be addressed. Usually it's just timeouts and things like that.
> >
> > If Unbound doesn't have its own, and ldaptive doesn't have a "generic" one, then I wouldn't have any suggestion, and I don't know what they would be if they do exist. I'd post to -users, as this isn't a dev topic, Daniel might know.
> >
> > -- Scott
> >
> >
> > --
> > To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net