shibtest and active directory: CREDENTIALS NOT RECOGNIZED
Mauro Minella
Mauro.Minella at microsoft.com
Sun Sep 9 11:25:22 EDT 2012
Thanks David &all,
I really hoped this was the reason why it didn't work, as well as the ! char in the password (which now is abc123ABC).
Unfortunately, I'm still at the basic point: 3268 does work, but CREDENTIALS NOT RECOGNIZED.
I really do not know what to think. Maybe Java7 that I installed should be replaced with Java6?
Mauro
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Bantz
Sent: venerdì 7 settembre 2012 19.26
To: Shib Users
Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED
Mauro, this may not be pertinent but I note that in the configuration quoted below, you have both ssl='"true" and a port of 389; your successful search with ldapsearch you quoted in another email used non-ssl; my config follows the the recommendation Rod Widdowson also pointed to - port 3269 for ssl="true" (3268 if not using ssl).
And of course, your userField will not be the same as in my Domain, as 'uaidentifier' is locally defined in my Domain.
David Bantz
UA OIT IAM
On Thu, 6 Sep 2012, at 16:07 , Mauro Minella <Mauro.Minella at microsoft.com> wrote:
> Actually my config was created by the setup program, taking information from the fields required in the wizard.
> However I replaced my config with yours:
> ///////////////////////////////////////////////////////////
> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
> ldapUrl="ldap://shibidp.shibdomain.local:389"
> baseDn="CN=Users,DC=shibdomain,DC=local"
> bindDn="CN=Administrator,CN=Users,DC=shibdomain,DC=local"
> bindCredential="WRONGPASSWORD"
> subtreeSearch="true"
> ssl="true"
> tls="false"
> userField="sAMAccountName,uaIdentifier";
> ///////////////////////////////////////////////////////////
> but still - Authentication failed.
>
> BTW, I said a wrong thing before: if I use a WRONG password in
> attribute-resolver.xml AND in login.config
> *****************
> <resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
> ldapURL="ldap://SHIBDOMAIN.LOCAL:389" baseDN="CN=Users,DC=shibdomain,DC=local" principal="administrator at shibdomain.local"
> principalCredential=" WRONGPASSWORD ">
> <FilterTemplate>
> <![CDATA[
> (sAMAccountName=$requestContext.principalName)
> ]]>
> </FilterTemplate>
>
> <!-- We rely on the uniqueness of the objectSid. But it is binary so we *must* make it so -->
> <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
> <!-- If we are following from the GC we need thus on -->
> <LDAPProperty name="java.naming.referral" value="follow"/>
>
> </resolver:DataConnector>
> *****************
> , I get a different error, also reported in the id_process.log:
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the following parameters:
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - authtype = simple
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - dn = administrator at shibdomain.local
> 02:05:01.484 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] - credential = <suppressed>
> 02:05:01.515 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:167] - Error
> connecting to LDAP URL: ldap://SHIBDOMAIN.LOCAL:389
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> So this means I'm connecting to LDAP with the right credentials, right? So, how can I understand what is the problem here?
>
> Thanks,
>
> Mauro
>
> -----Original Message-----
> From: users-bounces at shibboleth.net
> [mailto:users-bounces at shibboleth.net] On Behalf Of David Bantz
> Sent: venerdì 7 settembre 2012 01.44
> To: Shib Users
> Subject: Re: shibtest and active directory: CREDENTIALS NOT RECOGNIZED
>
>
> On Thu, 6 Sep 2012, at 15:38 , David Bantz <dabantz at alaska.edu> wrote:
>
> hmmm
> My config looks closer to the documentation and example at
>
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
>
> excerpt:
>
> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
> ldapUrl="ldap://......ad.alaska.edu:3269 ldap://......ad.alaska.edu:3269"
> baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
> bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
> bindCredential="........"
> subtreeSearch="true"
> ssl="true"
> tls="false"
> userField="sAMAccountName,uaIdentifier";
>
> In this case I would use ldapsearch (even easier in Apache Directory Studio from http://directory.apache.org/studio) to bind to one of the two (in my case) fully qualified URLs for our AD, using the bindDN and bindCredential to authenticate to AD.
>
> David Bantz
> UA OIT IAM
>
> On Thu, 6 Sep 2012, at 15:19 , Mauro Minella <Mauro.Minella at microsoft.com> wrote:
>
>> Thanks David, Nate.
>>
>> Actually I'm new to Shib so I kindly ask you to elaborate your suggested test which looks very interesting:
>> >> can you bind to AD url in login.config with the IdP's credentials
>> in login.config using straight command-line
>>
>>
>> This is my LOGIN.CONF file, which was created by the setup. I can just say that if I set a wrong password, I get the same error. But the password is right!
>> //////////////
>>
>> ShibUserPassAuth {
>>
>> // Example LDAP authentication
>> // See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
>>
>> edu.vt.middleware.ldap.jaas.LdapLoginModule required
>> host="SHIBDOMAIN.LOCAL"
>> port="389"
>> base="CN=Users,DC=shibdomain,DC=local"
>> serviceCredential="*****"
>> userRoleAttribute="sAMAccountName"
>> serviceUser="adreader at shibdomain.local"
>> subtreeSearch = "true"
>> userField="samAccountName";
>>
>> // Example Kerberos authentication, requires Sun's JVM // See:
>> https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
>> /*
>> com.sun.security.auth.module.Krb5LoginModule required
>> useKeyTab="true"
>> keyTab="/path/to/idp/keytab/file";
>> */
>>
>> };
>> ////////////////////////
>>
>> I've increased the logging level as suggested by Nate, but it seems
>> it's not enough: after restarting Apache, I just get
>>
>> -------------- idp-access.log START---------------
>> 20120906T220259Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/R
>> 20120906T220259Z|e
>> 20120906T220259Z|direct/SSO|
>> 20120906T224154Z|89.145.108.206|shibidp.eduteamit.com:443|/profile/Me
>> 20120906T224154Z|t
>> 20120906T224154Z|adata/SAML|
>> 20120906T224630Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/R
>> 20120906T224630Z|e
>> 20120906T224630Z|direct/SSO|
>> 20120906T225546Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/R
>> 20120906T225546Z|e
>> 20120906T225546Z|direct/SSO|
>> 20120906T225940Z|89.145.108.208|shibidp.eduteamit.com:443|/profile/Me
>> 20120906T225940Z|t
>> 20120906T225940Z|adata/SAML|
>> -------------- idp-access.log END---------------
>>
>> -------------- idp-process.log START---------------
>> 01:14:13.312 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
>> Loading new configuration for service shibboleth.AttributeResolver
>> 01:14:13.327 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for PrincipalConnector plugin with ID: shibTransient
>> 01:14:13.327 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for PrincipalConnector plugin with ID: saml1Unspec
>> 01:14:13.327 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for PrincipalConnector plugin with ID: saml2Transient
>> 01:14:13.327 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for DataConnector plugin with ID: staticAttributes
>> 01:14:13.343 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for DataConnector plugin with ID: myLDAP
>> 01:14:13.343 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for DataConnector plugin with ID: computedID
>> 01:14:13.343 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for AttributeDefinition plugin with ID:
>> eduPersonAffiliation
>> 01:14:13.359 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for AttributeDefinition plugin with ID:
>> eduPersonPrincipalName
>> 01:14:13.359 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for AttributeDefinition plugin with ID:
>> eduPersonScopedAffiliation
>> 01:14:13.359 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for AttributeDefinition plugin with ID:
>> eduPersonTargetedID.old
>> 01:14:13.359 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for AttributeDefinition plugin with ID:
>> eduPersonTargetedID
>> 01:14:13.359 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.resolver.
>> AbstractResolutionPlugInBeanDefinitionParser:54] - Parsing
>> configuration for AttributeDefinition plugin with ID: transientId
>> 01:14:13.406 - WARN [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ComputedIDDataConnector:64] - This data connector is deprecated. The StoredID data connector should be used in its place.
>> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:73] - Bind with the following parameters:
>> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - authtype = simple
>> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] - dn = adreader at shibdomain.local
>> 01:14:13.546 - DEBUG [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:82] - credential = <suppressed>
>> 01:14:13.546 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:179] -
>> shibboleth.AttributeResolver service loaded new configuration
>> 01:14:13.562 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
>> Loading new configuration for service
>> shibboleth.AttributeFilterEngine
>> 01:14:13.562 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.attribute.filterin
>> g .AttributeFilterPolicyBeanDefinitionParser:71] - Parsing
>> configuration for attribute filter policy releaseAnyone
>> 01:14:13.593 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:179] -
>> shibboleth.AttributeFilterEngine service loaded new configuration
>> 01:14:13.609 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
>> Loading new configuration for service
>> shibboleth.SAML1AttributeAuthority
>> 01:14:13.609 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
>> Loading new configuration for service
>> shibboleth.SAML2AttributeAuthority
>> 01:14:13.609 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
>> Loading new configuration for service
>> shibboleth.RelyingPartyConfigurationManager
>> 01:14:13.734 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.relyingparty.Relyi
>> n gPartyConfigurationBeanDefinitionParser:71] - Parsing configuration
>> for relying party with id: anonymous
>> 01:14:13.734 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.relyingparty.Relyi
>> n gPartyConfigurationBeanDefinitionParser:71] - Parsing configuration
>> for relying party with id: default
>> 01:14:13.734 - WARN
>> [edu.internet2.middleware.shibboleth.common.config.SpringConfiguratio
>> n Utils:271] - Numerical duration form is deprecated. The property
>> 'assertionLifetime' on profile configuration of type
>> {urn:mace:shibboleth:2.0:relying-party:saml}ShibbolethSSOProfile
>> should use the duration notation: PT5M0.000S
>> 01:14:13.734 - WARN
>> [edu.internet2.middleware.shibboleth.common.config.SpringConfiguratio
>> n Utils:271] - Numerical duration form is deprecated. The property
>> 'assertionLifetime' on profile configuration of type
>> {urn:mace:shibboleth:2.0:relying-party:saml}SAML1AttributeQueryProfil
>> e should use the duration notation: PT5M0.000S
>> 01:14:13.749 - WARN
>> [edu.internet2.middleware.shibboleth.common.config.SpringConfiguratio
>> n Utils:271] - Numerical duration form is deprecated. The property
>> 'assertionLifetime' on profile configuration of type
>> {urn:mace:shibboleth:2.0:relying-party:saml}SAML2SSOProfile should
>> use the duration notation: PT5M0.000S
>> 01:14:13.749 - WARN
>> [edu.internet2.middleware.shibboleth.common.config.SpringConfiguratio
>> n Utils:271] - Numerical duration form is deprecated. The property
>> 'assertionLifetime' on profile configuration of type
>> {urn:mace:shibboleth:2.0:relying-party:saml}SAML2AttributeQueryProfil
>> e should use the duration notation: PT5M0.000S
>> 01:14:13.749 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.AbstractX
>> 5 09CredentialBeanDefinitionParser:62] - Parsing configuration for
>> X509Filesystem credential with id: IdPCredential
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.ChainingS
>> i gnatureTrustEngineBeanDefinitionParser:58] - Parsing configuration
>> for SignatureChaining trust engine with id:
>> shibboleth.SignatureTrustEngine
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.MetadataE
>> x plicitKeySignatureTrustEngineBeanDefinitionParser:49] - Parsing
>> configuration for MetadataExplicitKeySignature trust engine with id:
>> shibboleth.SignatureMetadataExplicitKeyTrustEngine
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.MetadataP
>> K IXSignatureTrustEngineBeanDefinitionParser:47] - Parsing
>> configuration for MetadataPKIXSignature trust engine with id:
>> shibboleth.SignatureMetadataPKIXTrustEngine
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.ChainingT
>> r ustEngineBeanDefinitionParser:58] - Parsing configuration for
>> Chaining trust engine with id: shibboleth.CredentialTrustEngine
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.MetadataE
>> x plicitKeyTrustEngineBeanDefinitionParser:47] - Parsing
>> configuration for MetadataExplicitKey trust engine with id:
>> shibboleth.CredentialMetadataExplictKeyTrustEngine
>>
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.MetadataP
>> K IXX509CredentialTrustEngineBeanDefinitionParser:47] - Parsing
>> configuration for MetadataPKIXX509Credential trust engine with id:
>> shibboleth.CredentialMetadataPKIXTrustEngine
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.Shibbolet
>> h SecurityPolicyBeanDefinitionParser:58] - Parsing configuration for
>> SecurityPolicyType security policy with id:
>> shibboleth.ShibbolethSSOSecurityPolicy
>> 01:14:13.812 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.Shibbolet
>> h SecurityPolicyBeanDefinitionParser:58] - Parsing configuration for
>> SecurityPolicyType security policy with id:
>> shibboleth.SAML1AttributeQuerySecurityPolicy
>> 01:14:13.827 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.Shibbolet
>> h SecurityPolicyBeanDefinitionParser:58] - Parsing configuration for
>> SecurityPolicyType security policy with id:
>> shibboleth.SAML1ArtifactResolutionSecurityPolicy
>> 01:14:13.827 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.Shibbolet
>> h SecurityPolicyBeanDefinitionParser:58] - Parsing configuration for
>> SecurityPolicyType security policy with id:
>> shibboleth.SAML2SSOSecurityPolicy
>> 01:14:13.827 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.Shibbolet
>> h SecurityPolicyBeanDefinitionParser:58] - Parsing configuration for
>> SecurityPolicyType security policy with id:
>> shibboleth.SAML2AttributeQuerySecurityPolicy
>> 01:14:13.827 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.Shibbolet
>> h SecurityPolicyBeanDefinitionParser:58] - Parsing configuration for
>> SecurityPolicyType security policy with id:
>> shibboleth.SAML2ArtifactResolutionSecurityPolicy
>> 01:14:13.827 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.security.Shibbolet
>> h SecurityPolicyBeanDefinitionParser:58] - Parsing configuration for
>> SecurityPolicyType security policy with id:
>> shibboleth.SAML2SLOSecurityPolicy
>> 01:14:52.512 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:179] -
>> shibboleth.RelyingPartyConfigurationManager service loaded new
>> configuration
>> 01:14:52.528 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
>> Loading new configuration for service shibboleth.HandlerManager
>> 01:14:52.528 - INFO [edu.internet2.middleware.shibboleth.common.config.profile.JSPErrorHandlerBeanDefinitionParser:45] - Parsing configuration for JSP error handler.
>> 01:14:52.528 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: Status
>> 01:14:52.528 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAMLMetadata
>> 01:14:52.528 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: ShibbolethSSO
>> 01:14:52.528 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAML1AttributeQuery
>> 01:14:52.528 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAML1ArtifactResolution
>> 01:14:52.543 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAML2SSO
>> 01:14:52.543 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAML2SSO
>> 01:14:52.543 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAML2SSO
>> 01:14:52.543 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAML2AttributeQuery
>> 01:14:52.543 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.profile.AbstractRe
>> q uestURIMappedProfileHandlerBeanDefinitionParser:42] - Parsing
>> configuration for profile handler: SAML2ArtifactResolution
>> 01:14:52.715 - INFO
>> [edu.internet2.middleware.shibboleth.common.config.BaseService:179] -
>> shibboleth.HandlerManager service loaded new configuration
>> 01:14:53.027 - INFO [Shibboleth-Access:73] -
>> 20120906T231453Z|127.0.0.1|shibidp.eduteamit.com:443|/profile/SAML2/R
>> 20120906T231453Z|e
>> direct/SSO|
>> -------------- idp-process.log END---------------
>>
>> //////////////
>>
>> Thanks again
>>
>> Mauro
>>
>>
>> -----Original Message-----
>> From: users-bounces at shibboleth.net
>> [mailto:users-bounces at shibboleth.net] On Behalf Of David Bantz
>> Sent: venerdì 7 settembre 2012 01.00
>> To: Shib Users
>> Subject: Re: shibtest and active directory: CREDENTIALS NOT
>> RECOGNIZED
>>
>> Simple possible first tests (if you have not already verified):
>> - can you bind to AD url in login.config with the IdP's credentials in login.config using straight command-line?
>> - if so, does binding with those cred's allow you retrieve the dn of a user with the end-username provided in the web login page?
>> - if so, can you bind with end user's cred's in command line?
>>
>> David Bantz
>> UA OIT IAM
>>
>> On Thu, 6 Sep 2012, at 14:17 , Mauro Minella <Mauro.Minella at microsoft.com> wrote:
>>
>>> Hi,
>>> I setup Shibboleth idp 2.3.5 on a brand new virtual machine with Windows Server 2008 R2, which is a domain controller.
>>> Internal domain name: SHIBIDP.LOCAL
>>> The same machine is reachable from the extern through
>>> SHIBIDP.EDUTEAMIT.COM I configured Shibboleth IDP following the
>>> guide on
>>> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPQuickInstall
>>> ,
>>>
>>> Dns name: shibidp.eduteamit.com
>>> Active directory domain: shibdomain.local
>>> Scope: shibdomain.local
>>>
>>>
>>> I generated the certificate with Java and now I can open the following links correctly and with no errors:
>>> - https://shibidp.eduteamit.com
>>> - https://shibidp.eduteamit.com/idp/status
>>> - https://shibidp.eduteamit.com/idp/profile/Metadata/SAML
>>>
>>> So I tried to test it via https://www.testshib.org/index.html: I registered my metadata file, I configured /opt/shibboleth-idp/conf/relying-party.xml as described on https://www.testshib.org/configure.html, then I opened https://sp.testshib.org/ and entered https://shibidp.eduteamit.com/idp/shibboleth and -GREAT!- I got the Shibboleth authentication web page.
>>>
>>> The problem is that whatever username/password I put, I get the error CREDENTIALS NOT RECOGNIZED.
>>>
>>>
>>> Any hints would be greatly appreciated.
>>>
>>> Thank you in advance,
>>>
>>> Mauro
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list