Problems authenticating with TestShib

[Peter Schober]

* mstech <msimpson at amersham.ac.uk> [2013-06-24 13:43]:
> I have the login.confif working as expected and allowing logins from users
> either in the staff OU or Computer Services:
> 
> ShibUserPassAuth {
> 
> 
>    edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>      
> 	  host="domaincontroller.amersham.ac.uk"
> 	  port="389"
> 	  base="ou=staff,dc=amersham,dc=ac,dc=uk"
> 	  subtreeSearch="true"
> 	  tls="false"
> 	  ssl="false"
> 	  userFilter="userPrincipalName={0}"
> 	  userField="userPrincipalName"
> 	  serviceUser="cn=******,ou=staff,dc=amersham,dc=ac,dc=uk"
> 	  serviceCredential="*****";
> 	  
> 	  edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>      
> 	  host="domain controller.amersham.ac.uk"
> 	  port="389"
> 	  base="ou=computer services,dc=amersham,dc=ac,dc=uk"
> 	  subtreeSearch="true"
> 	  tls="false"
> 	  ssl="false"
> 	  userFilter="userPrincipalName={0}"
> 	  userField="userPrincipalName"
> 	  serviceUser="cn=****,ou=staff,dc=amersham,dc=ac,dc=uk"
> 	  serviceCredential="*****";

Why not set the base to dc=amersham,dc=ac,dc=uk when you're doing a
subtreeSearch anyway?

> However my problem is I cant work out how to perform a similar
> operation on the attribute resolver.  At present I have this config:

If you can't simply use a single subtree search to find all subjects
and their attributes you could create two seperate DataConnectors
searching in different parts (or servers) and have attribute
definitions depend on both. Or have one defined as failover connector
for the other.
-peter