Shib to AD LDAP

[Arjuna Scagnetto]

The Ad issue binding an idp to AD are very well reported on the
shibboleth wiki.

In practice if you need to cross the root of an AD domain, for example
because you have two OU sons of the root in which you have the users you
need to authenticate, it will send back to you a referral to the
dnsforest, even if you are not in a forest.

Since vt-ldap jaas is configured to not follow referrals you need to say:

in login.config

referral="follow"

in attribure-resolver.xml

<dc:LDAPProperty name="java.naming.referral" value="follow"/>

I've seen in my practice that a dns roundrobin pointing at the same name
that dnsforest points too will cause some problem to the idp. I've found
a solution but it's not very elegant and it's not scalable.

Arjuna



On 05/08/2011 17.18, Saeed Pater-Rov wrote:
> It's a Linux IDP system connecting to Microsoft AD for LDAP.
> 
> A copy of your handler.xml and login.config would be awesome. And any
> other files I'm not thinking about.
> 
> Thanks!
> 
> 
> 
> From:        Arjuna Scagnetto <ascagnetto at units.it>
> To:        Shib Users <users at shibboleth.net>
> Date:        08/05/2011 07:56 AM
> Subject:        Re: Shib to AD LDAP
> Sent by:        users-bounces at shibboleth.net
> ------------------------------------------------------------------------
> 
> 
> 
> But are you speaking of the idp binding to AD or running an idp on a
> windows server?
> 
> if the former maybe i can provide my login.config and resolver.
> 
> Arjuna
> 
> On 05/08/2011 9.00, Rod Widdowson wrote:
>>
> http://svn.shibboleth.net/view/extensions/w2k3-installer/trunk/Shib2Respository/ShibConfig/conf-tmlp/
>>
>> Has the files I  package into the "quick installer for AD".  It does
> what is needed to login but it is highly unambitious for
>> attributes.  It also delegates responsibility for decided whether to
> use the GC or not to the user.
>>
>>> From: users-bounces at shibboleth.net
> [mailto:users-bounces at shibboleth.net] On Behalf Of Saeed Pater-Rov
>>> Sent: 05 August 2011 03:28
>>> To: users at shibboleth.net
>>> Subject: Shib to AD LDAP
>>>
>>> I've been reading the Shibboleth to LDAP AD documentation but was
> wondering
>>> if someone out there was using the same config and could provide a
> copy of
>>> their handler.xml and login.config files for me please. (and other
> important
>>> files I possibly didn't mention)
>>>
>>> Thanks.
>>
>> --
>> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> 
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net