shibtest and active directory: CREDENTIALS NOT RECOGNIZED

[Mauro Minella]

This issue is driving me crazy... I can't imagine it's so hard to make it work. And it's quite frustrating receiving a generic "credentials not recognized" with no more information.

So I installed LDAPSearch, I ran a query as [adreader at shibdomain.local / abc123!] - YES, that's the password, including the exclamation mark, if anyone wants to try from everywere on Internet (server shibidp.eduteamit.com, port 389). I ran a query for "CN=ad reader,CN=Users,DC=shibdomain,DC=local" and it seems working (see below), isn't it? 

BTW, to be precise I could not follow exactly the 2 steps required on https://www.testshib.org/configure.html
>>> 1.Uncomment the URLMD <MetadataProvider>. Change the metadataURL to http://www.testshib.org/metadata/testshib-two-metadata.xml and the backingFile to something like testshib.xml.
>>> 2.Comment out the <MetadataFilter> elements inside the URLMD <MetadataProvider>.
Because I do NOT have any  <MetadataFilter> section in my relying-party.xml (which is installed with default options), and I set the first link ...testshib-two-metadata.xml in the section " <MetadataProvider id="TestShib" xsi:type="FileBackedHTTPMetadataProvider" " which is the only one I have with metadaURL in relying-party.xml. I hope this is not the reason why can't authenticate.


And this is the output of the LDAP query:

LDAP Search is started ....
     Host = shibidp.eduteamit.com 
     Port = 389 
     Connection Type = Non SSL 
     Timeout = 10 seconds

STEP 1 => Performing LDAP initialization
LDAP initialization completed

STEP 2 => Connecting to LDAP server using the given credentials...
LDAP bind completed successfully.

STEP 3 => Searching on the server ...

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Enumerating attributes for DN : CN=ad reader,CN=Users,DC=shibdomain,DC=local 
objectClass = top
objectClass = person
objectClass = organizationalPerson
objectClass = user
cn = ad reader
sn = reader
givenName = ad
distinguishedName = CN=ad reader,CN=Users,DC=shibdomain,DC=local
instanceType = 4
whenCreated = 20120903195453.0Z
whenChanged = 20120907085644.0Z
displayName = ad reader
uSNCreated = 12758
uSNChanged = 16452
name = ad reader
objectGUID = Ï÷-'÷
userAccountControl = 66048
badPwdCount = 0
codePage = 0
countryCode = 0
badPasswordTime = 129914817680798060
lastLogoff = 0
lastLogon = 129914817741104235
pwdLastSet = 129914818041814155
primaryGroupID = 513
objectSid = 

accountExpires = 9223372036854775807
logonCount = 0
sAMAccountName = adreader
sAMAccountType = 805306368
userPrincipalName = adreader at shibdomain.local
lockoutTime = 0
objectCategory = CN=Person,CN=Schema,CN=Configuration,DC=shibdomain,DC=local
dSCorePropagationData = 16010101000000.0Z
lastLogonTimestamp = 129914416319360544

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------

LDAP search is completed


Thank you

Mauro

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: venerdì 7 settembre 2012 02.33
To: Shib Users
Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED

Mauro,

My guess is that the IdP can't connect to that URL at all.  Have you tried telnetting to shibdomain.local 389 or using a simple LDAP command line client to connect to the directory, as David suggested?

Thanks,
Nate.

On Sep 7, 2012, at 0:07 , Mauro Minella wrote:


02:05:01.515 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:167] - Error connecting to LDAP URL: ldap://SHIBDOMAIN.LOCAL:389