shibtest and active directory: CREDENTIALS NOT RECOGNIZED

David Bantz dabantz at alaska.edu
Thu Sep 6 19:43:58 EDT 2012 

On Thu, 6 Sep 2012, at 15:38 , David Bantz <dabantz at alaska.edu> wrote:

hmmm 
My config looks closer to the documentation and example at 

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass

excerpt:

edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
 ldapUrl="ldap://•••••.ad.alaska.edu:3269 ldap://•••••.ad.alaska.edu:3269"
 baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
 bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
 bindCredential="••••••••"
 subtreeSearch="true"
 ssl="true"
 tls="false"
 userField="sAMAccountName,uaIdentifier";

In this case I would use ldapsearch (even easier in Apache Directory Studio from http://directory.apache.org/studio) to bind to one of the two (in my case) fully qualified URLs for our AD, using the bindDN and bindCredential to authenticate to AD.

David Bantz
UA OIT IAM

On Thu, 6 Sep 2012, at 15:19 , Mauro Minella <Mauro.Minella at microsoft.com> wrote:

> Thanks David, Nate.
> 
> Actually I'm new to Shib so I kindly ask you to elaborate your suggested test which looks very interesting:
> 	>> can you bind to AD url in login.config with the IdP's credentials in login.config using straight command-line
> 
> 
> This is my LOGIN.CONF  file, which was created by the setup. I can just say that if I set a wrong password, I get the same error. But the password is right! 
> //////////////
> 
> ShibUserPassAuth {
> 
> // Example LDAP authentication
> // See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
> 
>  edu.vt.middleware.ldap.jaas.LdapLoginModule required
>     host="SHIBDOMAIN.LOCAL"
>     port="389"
>     base="CN=Users,DC=shibdomain,DC=local"
>     serviceCredential="*****"
>     userRoleAttribute="sAMAccountName"
>     serviceUser="adreader at shibdomain.local"
>     subtreeSearch = "true"
>     userField="samAccountName";
> 
> // Example Kerberos authentication, requires Sun's JVM
> // See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
> /*
>  com.sun.security.auth.module.Krb5LoginModule required
>     useKeyTab="true"
>     keyTab="/path/to/idp/keytab/file";
> */
> 
> };
> ////////////////////////
> 
> I've increased the logging level as suggested by Nate, but it seems it's not enough: after restarting Apache, I just get
> 
> -------------- idp-access.log START---------------
> 20120906T220259Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> 20120906T224154Z|89.145.108.206|shibidp.eduteamit.com:443|/profile/Metadata/SAML|
> 20120906T224630Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> 20120906T225546Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> 20120906T225940Z|89.145.108.208|shibidp.eduteamit.com:443|/profile/Metadata/SAML|
> -------------- idp-access.log END---------------
> 
> -------------- idp-process.log START---------------
> 01:14:13.312 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.AttributeResolver
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for PrincipalConnector plugin with ID: shibTransient
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for PrincipalConnector plugin with ID: saml1Unspec
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for PrincipalConnector plugin with ID: saml2Transient
> 01:14:13.327 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for DataConnector plugin with ID: staticAttributes
> 01:14:13.343 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for DataConnector plugin with ID: myLDAP
> 01:14:13.343 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for DataConnector plugin with ID: computedID
> 01:14:13.343 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonAffiliation
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonPrincipalName
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonScopedAffiliation
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonTargetedID.old
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: eduPersonTargetedID
> 01:14:13.359 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing configuration for AttributeDefinition plugin with ID: transientId
> 01:14:13.406 - WARN [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ComputedIDDataConnector:64] - This data connector is deprecated.  The StoredID data connector should be used in its place.
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the following parameters:
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] -   authtype = simple
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   dn = adreader at shibdomain.local
> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] -   credential = <suppressed>
> 01:14:13.546 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.AttributeResolver service loaded new configuration
> 01:14:13.562 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.AttributeFilterEngine
> 01:14:13.562 - INFO [edu.internet2.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser:71] - Parsing configuration for attribute filter policy releaseAnyone
> 01:14:13.593 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.AttributeFilterEngine service loaded new configuration
> 01:14:13.609 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.SAML1AttributeAuthority
> 01:14:13.609 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.SAML2AttributeAuthority
> 01:14:13.609 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.RelyingPartyConfigurationManager
> 01:14:13.734 - INFO [edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser:71] - Parsing configuration for relying party with id: anonymous
> 01:14:13.734 - INFO [edu.internet2.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser:71] - Parsing configuration for relying party with id: default
> 01:14:13.734 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}ShibbolethSSOProfile should use the duration notation: PT5M0.000S
> 01:14:13.734 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}SAML1AttributeQueryProfile should use the duration notation: PT5M0.000S
> 01:14:13.749 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}SAML2SSOProfile should use the duration notation: PT5M0.000S
> 01:14:13.749 - WARN [edu.internet2.middleware.shibboleth.common.config.SpringConfigurationUtils:271] - Numerical duration form is deprecated. The property 'assertionLifetime' on profile configuration of type {urn:mace:shibboleth:2.0:relying-party:saml}SAML2AttributeQueryProfile should use the duration notation: PT5M0.000S
> 01:14:13.749 - INFO [edu.internet2.middleware.shibboleth.common.config.security.AbstractX509CredentialBeanDefinitionParser:62] - Parsing configuration for X509Filesystem credential with id: IdPCredential
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser:58] - Parsing configuration for SignatureChaining trust engine with id: shibboleth.SignatureTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataExplicitKeySignatureTrustEngineBeanDefinitionParser:49] - Parsing configuration for MetadataExplicitKeySignature trust engine with id: shibboleth.SignatureMetadataExplicitKeyTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataPKIXSignatureTrustEngineBeanDefinitionParser:47] - Parsing configuration for MetadataPKIXSignature trust engine with id: shibboleth.SignatureMetadataPKIXTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser:58] - Parsing configuration for Chaining trust engine with id: shibboleth.CredentialTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataExplicitKeyTrustEngineBeanDefinitionParser:47] - Parsing configuration for MetadataExplicitKey trust engine with id: shibboleth.CredentialMetadataExplictKeyTrustEngine
> 
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.MetadataPKIXX509CredentialTrustEngineBeanDefinitionParser:47] - Parsing configuration for MetadataPKIXX509Credential trust engine with id: shibboleth.CredentialMetadataPKIXTrustEngine
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.ShibbolethSSOSecurityPolicy
> 01:14:13.812 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML1AttributeQuerySecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML1ArtifactResolutionSecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2SSOSecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2AttributeQuerySecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2ArtifactResolutionSecurityPolicy
> 01:14:13.827 - INFO [edu.internet2.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser:58] - Parsing configuration for SecurityPolicyType security policy with id: shibboleth.SAML2SLOSecurityPolicy
> 01:14:52.512 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.RelyingPartyConfigurationManager service loaded new configuration
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:157] - Loading new configuration for service shibboleth.HandlerManager
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.JSPErrorHandlerBeanDefinitionParser:45] - Parsing configuration for JSP error handler.
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: Status
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAMLMetadata
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: ShibbolethSSO
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML1AttributeQuery
> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML1ArtifactResolution
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2SSO
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2SSO
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2SSO
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2AttributeQuery
> 01:14:52.543 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRequestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing configuration for profile handler: SAML2ArtifactResolution
> 01:14:52.715 - INFO [edu.internet2.middleware.shibboleth.common.config.BaseService:179] - shibboleth.HandlerManager service loaded new configuration
> 01:14:53.027 - INFO [Shibboleth-Access:73] - 20120906T231453Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/Redirect/SSO|
> -------------- idp-process.log END---------------
> 
> //////////////
> 
> Thanks again 
> 
> Mauro
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Bantz
> Sent: venerdì 7 settembre 2012 01.00
> To: Shib Users
> Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED
> 
> Simple possible first tests (if you have not already verified): 
> - can you bind to AD url in login.config with the IdP's credentials in login.config using straight command-line?
> - if so, does binding with those cred's allow you retrieve the dn of a user with the end-username provided in the web login page?
> - if so, can you bind with end user's cred's in command line?
> 
> David Bantz
> UA OIT IAM
> 
> On Thu, 6 Sep 2012, at 14:17 , Mauro Minella <Mauro.Minella at microsoft.com> wrote:
> 
>> Hi,
>> I setup Shibboleth idp 2.3.5 on a brand new virtual machine with Windows Server 2008 R2, which is a domain controller.
>> Internal domain name: SHIBIDP.LOCAL
>> The same machine is reachable from the extern through SHIBIDP.EDUTEAMIT.COM I configured Shibboleth IDP following the guide on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPQuickInstall,  
>> 
>> Dns name: shibidp.eduteamit.com
>> Active directory domain: shibdomain.local
>> Scope: shibdomain.local
>> 
>> 
>> I generated the certificate with Java and now I can open the following links correctly and with no errors:
>> - https://shibidp.eduteamit.com
>> - https://shibidp.eduteamit.com/idp/status
>> - https://shibidp.eduteamit.com/idp/profile/Metadata/SAML
>> 
>> So I tried to test it via https://www.testshib.org/index.html: I registered my metadata file, I configured /opt/shibboleth-idp/conf/relying-party.xml as described on https://www.testshib.org/configure.html, then I opened https://sp.testshib.org/ and entered https://shibidp.eduteamit.com/idp/shibboleth and -GREAT!- I got the Shibboleth authentication web page.
>> 
>> The problem is that whatever username/password I put, I get the error CREDENTIALS NOT RECOGNIZED.
>> 
>> 
>> Any hints would be greatly appreciated.
>> 
>> Thank you in advance,
>> 
>> Mauro
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

More information about the users mailing list