shibtest and active directory: CREDENTIALS NOT RECOGNIZED

Fri Sep 7 09:07:46 EDT 2012

Thanks Paul for your suggestion. 
Actually the useStartTLS variable was not set at all in attribute-resolver.xml, but even now that I set it to false, the problem is still the same.

Again, I'm convinced that I'm doing some useless efforts. I can't be the first user that needs to expose a standard AD via standard Shibboleth installation on Windows. I'd expect a step-by-step guide or even a wizard, rather than having to shoot in the dark setting new parameters and downloading external tools for troubleshooting.

However, I must make it work, whatever it takes. Please don't stop replying as done so far.

Thanks all for your help

Mauro

-----Original Message-----
From: Paul Brears [mailto:pbrears at rm.com] 
Sent: venerdì 7 settembre 2012 11.51
To: Mauro Minella
Subject: RE: shibtest and active directory: CREDENTIALS NOT RECOGNIZED

<resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc" 
        useStartTLS="false"

Have you got useStartTLS turned off?

I think the quick installer turns it on by default and it requires the SSL cert on the AD to be valid (there was a security update earlier this year where they spotted it wasn't validating the cert and fixed it) 

Try turning StartTLS off and see where you get to

Also if your using the quick installer Login.config is used to authenticate users on the forms authentication you've got another opportunity to get security breaking things...

edu.vt.middleware.ldap.jaas.LdapLoginModule required
      port="389"
      base="CN=Users,DC=....,DC=local"
      tls="false"

Regards,

Paul

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Mauro Minella
Sent: 07 September 2012 10:40
To: Shib Users
Subject: RE: shibtest and active directory: CREDENTIALS NOT RECOGNIZED

This issue is driving me crazy... I can't imagine it's so hard to make it work. And it's quite frustrating receiving a generic "credentials not recognized" with no more information.

So I installed LDAPSearch, I ran a query as [adreader at shibdomain.local / abc123!] - YES, that's the password, including the exclamation mark, if anyone wants to try from everywere on Internet (server shibidp.eduteamit.com, port 389). I ran a query for "CN=ad reader,CN=Users,DC=shibdomain,DC=local" and it seems working (see below), isn't it? 

BTW, to be precise I could not follow exactly the 2 steps required on https://www.testshib.org/configure.html
>>> 1.Uncomment the URLMD <MetadataProvider>. Change the metadataURL to http://www.testshib.org/metadata/testshib-two-metadata.xml and the backingFile to something like testshib.xml.
>>> 2.Comment out the <MetadataFilter> elements inside the URLMD <MetadataProvider>.
Because I do NOT have any  <MetadataFilter> section in my relying-party.xml (which is installed with default options), and I set the first link ...testshib-two-metadata.xml in the section " <MetadataProvider id="TestShib" xsi:type="FileBackedHTTPMetadataProvider" " which is the only one I have with metadaURL in relying-party.xml. I hope this is not the reason why can't authenticate.

And this is the output of the LDAP query:

LDAP Search is started ....
     Host = shibidp.eduteamit.com 
     Port = 389 
     Connection Type = Non SSL 
     Timeout = 10 seconds

STEP 1 => Performing LDAP initialization LDAP initialization completed

STEP 2 => Connecting to LDAP server using the given credentials...
LDAP bind completed successfully.

STEP 3 => Searching on the server ...

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Enumerating attributes for DN : CN=ad reader,CN=Users,DC=shibdomain,DC=local
objectClass = top
objectClass = person
objectClass = organizationalPerson
objectClass = user
cn = ad reader
sn = reader
givenName = ad
distinguishedName = CN=ad reader,CN=Users,DC=shibdomain,DC=local
instanceType = 4
whenCreated = 20120903195453.0Z
whenChanged = 20120907085644.0Z
displayName = ad reader
uSNCreated = 12758
uSNChanged = 16452
name = ad reader
objectGUID = Ï÷-'÷
userAccountControl = 66048
badPwdCount = 0
codePage = 0
countryCode = 0
badPasswordTime = 129914817680798060
lastLogoff = 0
lastLogon = 129914817741104235
pwdLastSet = 129914818041814155
primaryGroupID = 513
objectSid = 
accountExpires = 9223372036854775807
logonCount = 0
sAMAccountName = adreader
sAMAccountType = 805306368
userPrincipalName = adreader at shibdomain.local lockoutTime = 0 objectCategory = CN=Person,CN=Schema,CN=Configuration,DC=shibdomain,DC=local
dSCorePropagationData = 16010101000000.0Z lastLogonTimestamp = 129914416319360544

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------

LDAP search is completed

Thank you

Mauro

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
Sent: venerdì 7 settembre 2012 02.33
To: Shib Users
Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED

Mauro,

My guess is that the IdP can't connect to that URL at all.  Have you tried telnetting to shibdomain.local 389 or using a simple LDAP command line client to connect to the directory, as David suggested?

Thanks,
Nate.

On Sep 7, 2012, at 0:07 , Mauro Minella wrote:

02:05:01.515 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:167] - Error connecting to LDAP URL: ldap://SHIBDOMAIN.LOCAL:389

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net ____________________________________________________________________

RM Books - the first ever ebook system designed specifically for schools.

Coming in Autumn 2012 - pre-register for free now!

www.RMbookshelf.com

____________________________________________________________________

P.S. Think Green - don't print this email unless you really need to.
This message is confidential. You should not copy it or disclose its contents to anyone. You may use and apply the information only for the intended purpose. Internet communications are not secure and therefore RM Education does not accept legal responsibility for the contents of this message. Any views or opinions presented are only those of the author and not those of RM Education. If this email has come to you in error please delete it and any attachments. Please note that RM Education may intercept incoming and outgoing email communications.

RM Education plc is a company registered in England and Wales, Company Reg. No: 01148594; Registered Office: New Mill House, 183 Milton Park, Abingdon, OXON OX14 4SE; VAT No: 630 8236 56