shibtest and active directory: CREDENTIALS NOT RECOGNIZED

David Bantz dabantz at alaska.edu
Thu Sep 6 19:38:20 EDT 2012 

hmmm 
My config looks closer to the documentation and example at 

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass

excerpt:

edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
  ldapUrl="ldap://•••••.ad.alaska.edu:3269 ldap://•••••.ad.alaska.edu:3269"
  baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
  bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
  bindCredential="••••••••"
  subtreeSearch="true"
  ssl="true"
  tls="false"
  userField="sAMAccountName,uaIdentifier";

In this case I would use ldapsearch (even easier in Apache Directory Studio from http://directory.apache.org/studio) to bind to one of the two (in my case) fully qualified URLs for our AD, using t

David Bantz
UA OIT IAM

On Thu, 6 Sep 2012, at 15:19 , Mauro Minella <Mauro.Minella at microsoft.com> wrote:

> Thanks David, Nate.
> 
> Actually I'm new to Shib so I kindly ask you to elaborate your suggested test which looks very interesting:
> 	>> can you bind to AD url in login.config with the IdP's credentials in login.config using straight command-line
> 
> 
> This is my LOGIN.CONF  file, which was created by the setup. I can just say that if I set a wrong password, I get the same error. But the password is right! 
> //////////////
> 
> ShibUserPassAuth {
> 
> // Example LDAP authentication
> // See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
> 
>   edu.vt.middleware.ldap.jaas.LdapLoginModule required
>      host="SHIBDOMAIN.LOCAL"
>      port="389"
>      base="CN=Users,DC=shibdomain,DC=local"
>      serviceCredential="*****"
>      userRoleAttribute="sAMAccountName"
>      serviceUser="adreader at shibdomain.local"
>      subtreeSearch = "true"
>      userField="samAccountName";
> 
> // Example Kerberos authentication, requires Sun's JVM
> // See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
> /*
>   com.sun.security.auth.module.Krb5LoginModule required
>      useKeyTab="true"
>      keyTab="/path/to/idp/keytab/file";
> */
> 
> };
> ////////////////////////
> 
> I've increased the logging level as suggested by Nate, but it seems it's not enough: after restarting Apache, I just get
> 
> -------------- idp-access.log START---------------
> 20120906T220259Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> 20120906T224154Z|89.145.108.206|shibidp.eduteamit.com:443|/profile/Metadata/SAML|
> 20120906T224630Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> 20120906T225546Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> 20120906T225940Z|89.145.108.208|shibidp.eduteamit.com:443|/profile/Metadata/SAML|
> -------------- idp-access.log END---------------
> 
> -------------- idp-process.log START---------------
> 01:14:13.312 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.AttributeResolver
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for PrincipalConnector plugin with ID: shibTransient
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for PrincipalConnector plugin with ID: saml1Unspec
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for PrincipalConnector plugin with ID: saml2Transient
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for DataConnector plugin with ID: staticAttributes
> 01:14:13.343 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for DataConnector plugin with ID: myLDAP
> 01:14:13.343 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for DataConnector plugin with ID: computedID
> 01:14:13.343 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonAffiliation
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonPrincipalName
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonScopedAffiliation
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonTargetedID.old
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonTargetedID
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: transientId
> 01:14:13.406 - WARN [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ComputedIDDataConnector:64] - This data connector is deprecated.  The StoredID data connector should be used in its place.
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the following parameters:
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] -   authtype = simple
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   dn = adreader at shibdomain.local
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] -   credential = <suppressed>
> 01:14:13.546 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.AttributeResolver service loaded new configuration
> 01:14:13.562 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.AttributeFilterEngine
> 01:14:13.562 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser:71] - Parsing configuration for attribute filter policy releaseAnyone
> 01:14:13.593 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.AttributeFilterEngine service loaded new configuration
> 01:14:13.609 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.SAML1AttributeAuthority
> 01:14:13.609 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.SAML2AttributeAuthority
> 01:14:13.609 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.RelyingPartyConfigurationManager
> 01:14:13.734 - INFO [edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser:71] - Parsing configuration for relying party with id: anonymous
> 01:14:13.734 - INFO [edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser:71] - Parsing configuration for relying party with id: default
> 01:14:13.734 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}ShibbolethSSOProfile should use the duration notation: PT5M0.000S
> 01:14:13.734 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}SAML1AttributeQueryProfile should use the duration notation: PT5M0.000S
> 01:14:13.749 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}SAML2SSOProfile should use the duration notation: PT5M0.000S
> 01:14:13.749 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}SAML2AttributeQueryProfile should use the duration notation: PT5M0.000S
> 01:14:13.749 - INFO [edu.internet2.middleware.shibboleth.common.config.security.AbstractX509CredentialBeanDefinitionParser:62] - Parsing configuration for X509Filesystem credential with id: IdPCredential
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser:58] - Parsing configuration for SignatureChaining trust engine with id: shibboleth.SignatureTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataExplicitKeySignatureTrustEngineBeanDefinitionParser:49] - Parsing configuration for MetadataExplicitKeySignature trust engine with id: shibboleth.SignatureMetadataExplicitKeyTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataPKIXSignatureTrustEngineBeanDefinitionParser:47] - Parsing configuration for MetadataPKIXSignature trust engine with id: shibboleth.SignatureMetadataPKIXTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser:58] - Parsing configuration for Chaining trust engine with id: shibboleth.CredentialTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataExplicitKeyTrustEngineBeanDefinitionParser:47] - Parsing configuration for MetadataExplicitKey trust engine with id: shibboleth.CredentialMetadataExplictKeyTrustEngine
> 
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataPKIXX509CredentialTrustEngineBeanDefinitionParser:47] - Parsing configuration for MetadataPKIXX509Credential trust engine with id: shibboleth.CredentialMetadataPKIXTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.ShibbolethSSOSecurityPolicy
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML1AttributeQuerySecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML1ArtifactResolutionSecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2SSOSecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2AttributeQuerySecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2ArtifactResolutionSecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2SLOSecurityPolicy
> 01:14:52.512 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.RelyingPartyConfigurationManager service loaded new configuration
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.HandlerManager
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.JSPErrorHandlerBeanDefinitionParser:45] - Parsing configuration for JSP error handler.
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: Status
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAMLMetadata
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: ShibbolethSSO
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML1AttributeQuery
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML1ArtifactResolution
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2SSO
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2SSO
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2SSO
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2AttributeQuery
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2ArtifactResolution
> 01:14:52.715 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.HandlerManager service loaded new configuration
> 01:14:53.027 - INFO [Shibboleth-Access:73] - 20120906T231453Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> -------------- idp-process.log END---------------
> 
> //////////////
> 
> Thanks again 
> 
> Mauro
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Bantz
> Sent: venerdì 7 settembre 2012 01.00
> To: Shib Users
> Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED
> 
> Simple possible first tests (if you have not already verified): 
> - can you bind to AD url in login.config with the IdP's credentials in login.config using straight command-line?
> - if so, does binding with those cred's allow you retrieve the dn of a user with the end-username provided in the web login page?
> - if so, can you bind with end user's cred's in command line?
> 
> David Bantz
> UA OIT IAM
> 
> On Thu, 6 Sep 2012, at 14:17 , Mauro Minella <Mauro.Minella at microsoft.com> wrote:
> 
>> Hi,
>> I setup Shibboleth idp 2.3.5 on a brand new virtual machine with Windows Server 2008 R2, which is a domain controller.
>> Internal domain name: SHIBIDP.LOCAL
>> The same machine is reachable from the extern through SHIBIDP.EDUTEAMIT.COM I configured Shibboleth IDP following the guide on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPQuickInstall,  
>> 
>> Dns name: shibidp.eduteamit.com
>> Active directory domain: shibdomain.local
>> Scope: shibdomain.local
>> 
>> 
>> I generated the certificate with Java and now I can open the following links correctly and with no errors:
>> - https://shibidp.eduteamit.com
>> - https://shibidp.eduteamit.com/idp/status
>> - https://shibidp.eduteamit.com/idp/profile/Metadata/SAML
>> 
>> So I tried to test it via https://www.testshib.org/index.html: I registered my metadata file, I configured /opt/shibboleth-idp/conf/relying-party.xml as described on https://www.testshib.org/configure.html, then I opened https://sp.testshib.org/ and entered https://shibidp.eduteamit.com/idp/shibboleth and -GREAT!- I got the Shibboleth authentication web page.
>> 
>> The problem is that whatever username/password I put, I get the error CREDENTIALS NOT RECOGNIZED.
>> 
>> 
>> Any hints would be greatly appreciated.
>> 
>> Thank you in advance,
>> 
>> Mauro
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

More information about the users mailing list