shibtest and active directory: CREDENTIALS NOT RECOGNIZED

[Mauro Minella]

As said in my previous mails, if I use the same username/password with LDAP client (LDAPSEARCH), it works perfectly.
I'm 100% sure the password in the login attempt is right (tried tens of times), and I'm using the same UPN that I looked for with LDAPSEARCH.
I increased the logging level with <logger name="edu.vt.middleware.ldap" level="DEBUG/>
, however it seems this is not enough to tell me why the authentication fails. Which other logs could I turn up, in order to know why the authentication fails?


And this is the output of the LDAP query: I ran a query as [adreader at shibdomain.local / abc123!], looking for "CN=ad reader,CN=Users,DC=shibdomain,DC=local"

LDAP Search is started ....
     Host = shibidp.eduteamit.com 
     Port = 389 
     Connection Type = Non SSL 
     Timeout = 10 seconds

STEP 1 => Performing LDAP initialization LDAP initialization completed

STEP 2 => Connecting to LDAP server using the given credentials...
LDAP bind completed successfully.

STEP 3 => Searching on the server ...

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Enumerating attributes for DN : CN=ad reader,CN=Users,DC=shibdomain,DC=local
objectClass = top
objectClass = person
objectClass = organizationalPerson
objectClass = user
cn = ad reader
sn = reader
givenName = ad
distinguishedName = CN=ad reader,CN=Users,DC=shibdomain,DC=local
instanceType = 4
whenCreated = 20120903195453.0Z
whenChanged = 20120907085644.0Z
displayName = ad reader
uSNCreated = 12758
uSNChanged = 16452
name = ad reader
objectGUID = Ï÷-'÷
userAccountControl = 66048
badPwdCount = 0
codePage = 0
countryCode = 0
badPasswordTime = 129914817680798060
lastLogoff = 0
lastLogon = 129914817741104235
pwdLastSet = 129914818041814155
primaryGroupID = 513
objectSid =   
accountExpires = 9223372036854775807
logonCount = 0
sAMAccountName = adreader
sAMAccountType = 805306368
userPrincipalName = adreader at shibdomain.local lockoutTime = 0 objectCategory = CN=Person,CN=Schema,CN=Configuration,DC=shibdomain,DC=local
dSCorePropagationData = 16010101000000.0Z lastLogonTimestamp = 129914416319360544

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------

LDAP search is completed


Thank you

Mauro
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: venerdì 7 settembre 2012 16.25
To: Shib Users
Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED

On 9/7/12 10:07 AM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:
>
>As a matter of fact, I do not have errors in idp-process.log, but for 
>some reason https://shibidp.eduteamit.com/idp/Authn/UserPassword 
>replies saying "Authentication Failed" :-(

And there will still be a ton of debug logs if you turn logging up telling you exactly why the attempt failed. Chances are your user name isn't right or your search base is wrong, or the password in the login attempt itelf is wrong.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net