LDAP Connection
Ogunleye, Philip
Philip.Ogunleye at snapon.com
Tue Jan 15 09:53:52 EST 2013
Hi Douglas,
Thanks for your help, I looked a little further and found the issue,
although setup correctly in the directory the uid is not part of the dn
so the lookup on the uid was failing.
I amended the filter to search by cn={0} and this has resolved that
issue. It is finally authenticating, I will be writing out a document
for my team to ensure that nobody else suffers the pain that I've just
been through, I expect it's a bug in the version of the Apache Directory
Service.
I am now getting back a response, albeit a failure one for a strange
reason as the principal cannot be found. Despite the logs indicating
that it has found the user it says it cannot, I'll look into this and
have this resolved.
Thanks for your help
-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
On Behalf Of Douglas E. Engert
Sent: 14 January 2013 19:29
To: users at shibboleth.net
Subject: Re: LDAP Connection
On 1/14/2013 12:49 PM, Ogunleye, Philip wrote:
> Hi All,
>
> Think I'm down to my final issue with the setup. I have installed the
> apache directory service as I have had no luck connecting to Active
Directory. That being said my login.config has been attached but does
not appear to correct as it is still failing as shown below. I'm
confused as to why it is not connecting and would appreciate any help.
>
If ldap://read-auto-01-rv.snaponglobal.com is really AD, then you are
using the wrong attributes and port numbers.
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
<https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass>
has some examples "Example JAAS config for stacked Keberos + AD/LDAP
login modules"
AD uses sAMAccountName not uid for example.
> 18:34:07.234 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswo
> rdLoginServlet:170] - Attempting to authenticate user HK3585
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:180]
> - useFirstPass = false
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:181]
> - tryFirstPass = false
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:182]
> - storePass = false
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:183]
> - clearPass = false
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:184]
> - setLdapPrincipal = true
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:185]
> - setLdapDnPrincipal = false
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:186]
> - setLdapCredential = true
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:187]
> - defaultRole = []
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:188]
> - principalGroupName = null
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:189]
> - roleGroupName = null
>
> 18:34:07.265 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:77]
> - userRoleAttribute = []
>
> 18:34:07.296 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:83]
- Created authenticator:
> edu.vt.middleware.ldap.auth.AuthenticatorConfig at 27786030::env={java.na
<mailto:edu.vt.middleware.ldap.auth.AuthenticatorConfig at 27786030::env=%7
bjava.na>
> ming.provider.url=ldap://read-auto-01-rv.snaponglobal.com:10489,
> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}
>
> 18:34:07.296 - DEBUG
> [edu.vt.middleware.ldap.auth.SearchDnResolver:102] - Looking up DN
> using userFilter
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.auth.SearchDnResolver:193] - Search with the
following parameters:
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.auth.SearchDnResolver:194] - dn = o=mojo
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.auth.SearchDnResolver:195] - filter = uid={0}
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.auth.SearchDnResolver:196] - filterArgs =
[HK3585]
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.auth.SearchDnResolver:197] - searchControls =
javax.naming.directory.SearchControls at 6bedc9
<mailto:javax.naming.directory.SearchControls at 6bedc9>
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.auth.SearchDnResolver:198] - handler =
[edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at 1c83de7]
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with
the following parameters:
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -
authtype = simple
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] - dn =
uid=admin
>
> 18:34:07.296 - DEBUG
[edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -
credential = <suppressed>
>
> 18:34:07.312 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:163] - Error
> connecting to LDAP URL: ldap://read-auto-01-rv.snaponglobal.com:10489
>
> javax.naming.AuthenticationException: [LDAP: error code 49 - cannot
> bind the principalDn.]
>
> at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown
> Source) ~[na:1.7.0_09]
>
> at
> com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
> ~[na:1.7.0_09]
>
> at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
> ~[na:1.7.0_09]
>
> at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
> ~[na:1.7.0_09]
>
> at javax.naming.InitialContext.init(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> javax.naming.ldap.InitialLdapContext.<init>(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> edu.vt.middleware.ldap.handler.DefaultConnectionHandler.connectInterna
> l(DefaultConnectionHandler.java:134) ~[vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.handler.AbstractConnectionHandler.connect(Abstr
> actConnectionHandler.java:156) ~[vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.AbstractLdap.connect(AbstractLdap.java:1006)
> [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.AbstractLdap.getContext(AbstractLdap.java:1058)
> [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.AbstractLdap.search(AbstractLdap.java:214)
> [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.auth.SearchDnResolver.resolve(SearchDnResolver.
> java:139) [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.auth.Authenticator.getDn(Authenticator.java:106
> ) [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthent
> icator.java:74) [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.j
> ava:320) [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.auth.Authenticator.authenticate(Authenticator.j
> ava:277) [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.jaas.JaasAuthenticator.authenticate(JaasAuthent
> icator.java:60) [vt-ldap-3.3.6.jar:na]
>
> at
> edu.vt.middleware.ldap.jaas.LdapLoginModule.login(LdapLoginModule.java
> :103) [vt-ldap-3.3.6.jar:na]
>
> at
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> ~[na:1.7.0_09]
>
> at
> sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
> ~[na:1.7.0_09]
>
> at java.lang.reflect.Method.invoke(Unknown Source)
> ~[na:1.7.0_09]
>
> at
> javax.security.auth.login.LoginContext.invoke(Unknown Source)
> [na:1.7.0_09]
>
> at
> javax.security.auth.login.LoginContext.access$000(Unknown Source)
> [na:1.7.0_09]
>
> at
> javax.security.auth.login.LoginContext$4.run(Unknown Source)
> [na:1.7.0_09]
>
> at
> javax.security.auth.login.LoginContext$4.run(Unknown Source)
> [na:1.7.0_09]
>
> at java.security.AccessController.doPrivileged(Native
> Method) [na:1.7.0_09]
>
> at
> javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
> [na:1.7.0_09]
>
> at
> javax.security.auth.login.LoginContext.login(Unknown Source)
> [na:1.7.0_09]
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
<mailto:users-unsubscribe at shibboleth.net>
>
--
Douglas E. Engert <DEEngert at anl.gov <mailto:DEEngert at anl.gov> >
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130115/6eecb803/attachment-0001.html
More information about the users
mailing list