shibidp ECP extension configuration: REMOTE_USER not set

[Mauro Minella]

I made another step forward, maybe now it's just a LDAP query issue.

As I said, it seems that the same function ShibUserPassAuth
ShibUserPassAuth {
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="SHIBDOMAIN.LOCAL"
      port="389"
      base="CN=Users,DC=shibdomain,DC=local"
      serviceCredential="*****"
      serviceUser="adreader at shibdomain.local"
      subtreeSearch = "true"
      userField="userPrincipalName ";
};

in login.config does work with passive clients, but it returns
oct 05, 2012 9:55:00 AM org.apache.catalina.realm.JAASRealm authenticate
WARNING: Login exception authenticating username "john.smith"
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn
...
, if I use ECP.

Deepening ShibUserPassAuth, I noted that if I' NOT using the line
userFilter="(objectclass=*)"

If I add that line to ShibUserPassAuth, I get a different error:
ott 05, 2012 9:59:38 AM org.apache.catalina.realm.JAASRealm authenticate
WARNING: Login exception authenticating username "john.smith"
javax.security.auth.login.LoginException: Found more than (1) DN for: john.smith
at edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java:167)
...

Of course I have just 1 user "john.smith at shibdomain.eduteamit.com" in my Active Directory.

The first strange thing to me, is that this line is NOT needed for PASSIVE authentication, which works smoothly.
Anyway, I'm even willing to add it if it makes my solution work. Can you help me finding the right syntax to avoid the error?

Thanks

Mauro
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121005/29e4193f/attachment.html