Login issue

[Peter Schober]

* Gilles Badouet <badouetg at uni.coventry.ac.uk> [2013-07-05 01:05]:
> Hi Peter, 
> >How are you authenticating users in your IdP?
> >Do you use the default edu.vt.middleware.ldap.jaas.LdapLoginModule in
> >login.config? (If you post your config make sure to remove any
> >passwords prior to sending). If so the line I sent you should have
> >lots of information on the LDAP connection, try searching your
> >idp-process.log for lines with "fgrep edu.vt.middleware.ldap.jaas".
>
> I am authenticating users using LDAP through Apache Directory Studio
> 2.0.

Apache Directory Studio is a Directory User Agent ("client") but from
the web page I see it also contains an "Embedded ApacheDS" DSA.
  I don't see what connecting to something like this should achieve
(obviously this is unsuitable for any real use of the IdP and you
don't seem to know enough about the server to connect an LDAP client
to it) but that's your choice.

> I also tried OpenDJ 2.7 but was having the same issue.

The IdP can certainly connect to most or any LDAPv3 DSA, so if it
"doesn't work" it's something in the way you have set up things.
At the provided level of detail (none) it's not really possible to
suggest anything. How to get logs from your DSA is not a topic for
this list.

> I cant see the above lines in idp-process.log.

It will only be there if you modified your logging.xml as indicated in
a previous email (and either restarted the IdP or waited for 10
minutes for the modified logging config to become active).

Try changing other logging stuff (e.g. anything in there on INFO to
DEBUG) only to see whether that has an effect. When it does, change it
back.

> I just know that there is connection between IDP and LDAP server on
> a basis of the login page redirected when the resource is
> requested. The log content I see in LDAP DSA side is only about its
> internal operation and status and when I make a modification on it.

These two sentences sound contradictory to me. If the DSAs log does
not show /any/ connection from the IdP there simply might not be one.
Also the login page will always show up if the UsernamePassword
handler is active (and the RemoteUser one is not).

Impossible to say for me, of course, not knowing the DSA software and
its configuration (loggig, ACLs, etc.).

Ignoring the DSA (as I can't really help with that) lets concentrate
on getting your IdP logs going as described above.
-peter