shibboleth authentication with Active Directory UPN

[Mauro Minella]

Found: I should update it as follows

ShibUserPassAuth {
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="SHIBDOMAIN.LOCAL"
      port="389"
      base="CN=Users,DC=shibdomain,DC=local"
      serviceCredential="abc123ABC"
      userRoleAttribute="userPrincipalName"
      serviceUser="adreader at shibdomain.local"
      subtreeSearch = "true"
      userField=" userPrincipalName ";
};

Thanks ;-)

Mauro
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Mauro Minella
Sent: sabato 15 settembre 2012 02.24
To: Shib Users
Subject: RE: shibboleth authentication with Active Directory UPN

Thanks Cantor, I suppose you mean I should change the login.config file, right?

This is what I have in it, can you help me understanding what I should change, in order to allow the users authenticating with full UPN?

Thanks

Mauro

ShibUserPassAuth {
   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="SHIBDOMAIN.LOCAL"
      port="389"
      base="CN=Users,DC=shibdomain,DC=local"
      serviceCredential="abc123ABC"
      userRoleAttribute="sAMAccountName"
      serviceUser="adreader at shibdomain.local"
      subtreeSearch = "true"
      userField="samAccountName";
};

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: sabato 15 settembre 2012 00.58
To: Shib Users
Subject: Re: shibboleth authentication with Active Directory UPN

On 9/14/12 5:47 PM, "Mauro Minella" <Mauro.Minella at microsoft.com> wrote:
>QUESTION: how can the users be authenticated with the upn 
>(john.smith at shibdomain.eduteamit.com, abc123ABC), or even with the 
>domain account (shibdomain\johns, abc123ABC)?

LDAP authentication (this isn't about Shibboleth or AD) is based on "search then bind". You control the search filter used in the JAAS module.
After that, it binds by DN based on the search result. SO if you want a different input to work, you have to change the search filter.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net