Installation

[Peter Schober]

* Ogunleye, Philip <Philip.Ogunleye at snapon.com> [2012-12-20 16:28]:
> I have tested my Active Directory connection by creating a class that
> uses LDAP.  I was able to connect to active directory on 389 but cannot
> using the idp server.  I have attached my login.config for reference.
> My domain is snaponglobal, my username is HK3585.  Please view and let
> me know if I am supposed to change something for the IDP server to work.

I assume you've read the notes specific to your directory server implementation?
https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues#LdapServerIssues-MicrosoftActiveDirectory

# login.config
> edu.vt.middleware.ldap.jaas.LdapLoginModule required
>    host="Read-sgdc-03-pv"
>    port="389"
>    base="CN=Users,DC=snaponglobal,DC=com"
>    tls="true"
>    serviceCredential=""
>    userRoleAttribute="sAMAccountName"
>    serviceUser="hk3585 at snaponglobal.com"
>    subtreeSearch = "true"
>    userField="samAccountName";

A couple of comments:

 * Why didn't you start by modifying the default config of the IDP,
   which for 2.3.8 looks like this:

   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://ldap.example.org"
      baseDn="ou=people,dc=example,dc=org"
      ssl="true"
      userFilter="uid={0}";

  Most of the properties you have are not even listed in the
  documentation anymore:
  https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass

* With "my username" you're referring to the bindDn (for the
  LDAP search) you've gotten assigned by your LDAP admin? Or is that
  your personal account? If the latter would it have the necessary
  access controls to search for other users' DNs?

* You're binding to the server "Read-sgdc-03-pv" with the provided
  serviceUser but without a password? Is that intentional?
  I note that securing the connection with STARTTLS but not supplying
  a password seems rather unusual (unless client certs are in play,
  but then you'd probably need a authtype property, among others.)

* Your userField value has a difference spelling than
  userRoleAttribute. No idea whather that matters for M$-AD.

-peter