invalid dn - but admin says its not

[Daniel Fisher]

On Sun, Jul 7, 2013 at 11:03 PM, Oleg Chaikovsky <
oleg.chaikovsky at aegisidentity.com> wrote:

>  Hello – ****
>
> I am attempting to connect IdP 2.4 to an MSFT AD server.   The LDAP admin
> tells me that the dn he provided is correct. However, when I connect, and
> try to use testshib as a basic test, I get an invalid dn error (see part of
> idp-process.log below. ****
>
> ** **
>
> 19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:102] -
> Looking up DN using userFilter
>
> **
>
> 19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:193] -
> Search with the following parameters:****
>
> 19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:194] -
>   dn = ou=VVC Fac-Staff,dc=vvc,dc=edu****
>
> 19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:195]
> -   filter = sAMAccountName={0}****
>
> 19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:196]
> -   filterArgs = [Shibboleth.Ldap]****
>
> 19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:197]
> -   searchControls = javax.naming.directory.SearchControls at 465863****
>
> 19:46:55.209 - DEBUG [edu.vt.middleware.ldap.auth.SearchDnResolver:198]
> -   handler =
> [edu.vt.middleware.ldap.handler.FqdnSearchResultHandler at a54cbb9]****
>
> 19:46:55.209 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:74] - Bind with
> the following parameters:****
>
> 19:46:55.209 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:75] -   authtype =
> simple****
>
> 19:46:55.209 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:76] -   dn =
> cn=shibboleth ldap,ou=service accounts,dc=vvc,dc=edu****
>
> 19:46:55.209 - DEBUG
> [edu.vt.middleware.ldap.handler.DefaultConnectionHandler:83] -   credential
> = <suppressed>****
>
> 19:46:55.584 - INFO [edu.vt.middleware.ldap.auth.SearchDnResolver:161] -
> Search for user: Shibboleth.Ldap failed using filter: sAMAccountName={0}
>

The logs indicate you are attempting to authenticate the user name
'Shibboleth.Ldap', is this correct? If so, no entry was found using the
filter (sAMAccountName={0}) under ou=VVC Fac-Staff,dc=vvc,dc=edu. This can
be caused by a variety of issues, some of which are: you need a subtree
search, the service account you are using doesn't have the correct read
access, or the user name is misspelled. Check your LDAP logs and the
problem should become apparent.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130707/14033784/attachment.html