shibtest and active directory: CREDENTIALS NOT RECOGNIZED

[Mauro Minella]

Just to be on the same page: you David replied to my previous mail, where I was saying that if I use a wrong password, then I get the error I attached.

If, instead, I use the right password (adreader at shibdomain.local / abc123!) -the password includes the exclamation mark- I do not get any errors in the log files.

Now, using the right credentials, nothing changes if I replace ldap://SHIBDOMAIN.LOCAL:389 with ldap://shibidp.eduteamit.com:389, since both DNS names map to the same machine, and firewall ports are properly opened.
You can even try yourself using the same credentials.

As a matter of fact, I do not have errors in idp-process.log, but for some reason https://shibidp.eduteamit.com/idp/Authn/UserPassword replies saying "Authentication Failed" :-(

Thanks

Mauro

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: venerdì 7 settembre 2012 15.37
To: Shib Users
Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED

On Thu, Sep 6, 2012 at 8:07 PM, Mauro Minella <Mauro.Minella at microsoft.com> wrote:
> Actually my config was created by the setup program, taking information from the fields required in the wizard.
> However I replaced my config with yours:
> ///////////////////////////////////////////////////////////
> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>   ldapUrl="ldap://shibidp.shibdomain.local:389"
>   baseDn="CN=Users,DC=shibdomain,DC=local"
>   bindDn="CN=Administrator,CN=Users,DC=shibdomain,DC=local"
>   bindCredential="WRONGPASSWORD"
>   subtreeSearch="true"
>   ssl="true"
>   tls="false"
>   userField="sAMAccountName,uaIdentifier";
> ///////////////////////////////////////////////////////////
>  but still - Authentication failed.
>
> , I get a different error, also reported in the id_process.log:
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the following parameters:
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] -   authtype = simple
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   dn = administrator at shibdomain.local
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] -   credential = <suppressed>
> 02:05:01.515 - DEBUG 
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:167] - Error 
> connecting to LDAP URL: ldap://SHIBDOMAIN.LOCAL:389 
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>

There should be a stacktrace somewhere indicating why a connection could not be established. What happens if you change the url to
ldap://shibidp.eduteamit.com:389 ?

--Daniel Fisher
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net