LDAP Resolver not accepting BASEDN without OU?

[Ricardo Duarte]

Hi there,

I'm currently using Shibboleth with LDAP resolver, with the following config:


    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://dc.domain.local"
        baseDN="ou=people,dc=domain,dc=local"
        principal="cn=svc.ldap,cn=users,dc=domain,dc=local"
        principalCredential="mypassword">
        <resolver:Dependency ref="krb_principalname" />
        <dc:FilterTemplate>
            <![CDATA[
        (&(|(sAMAccountName=$requestContext.principalName)(userprincipalname=$requestContext.principalName))(objectclass=user))
            ]]>
        </dc:FilterTemplate>
    </resolver:DataConnector>

This is working fine.

But If I set the baseDN to "dc=domain,dc=local", the attribute resolver no longer works.
 I know my svc.ldap is allowed to perform searches under that DN. I know the user I search exists.

This is what is shown on the logs:

11:40:44.604 - ERROR [edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver:379] - Received the following error from data connector myLDAP, no failover data connector available
edu.internet2.middleware.shibboleth.common.attribute.resolver.AttributeResolutionException: An error occurred when attempting to search the LDAP
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.searchLdap(LdapDataConnector.java:372) ~[shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.resolve(LdapDataConnector.java:315) ~[shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.LdapDataConnector.resolve(LdapDataConnector.java:50) ~[shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ContextualDataConnector.resolve(ContextualDataConnector.java:77) ~[shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.dataConnector.ContextualDataConnector.resolve(ContextualDataConnector.java:31) ~[shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveDataConnector(ShibbolethAttributeResolver.java:374) [shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveDependencies(ShibbolethAttributeResolver.java:410) [shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttribute(ShibbolethAttributeResolver.java:332) [shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:284) [shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver.resolveAttributes(ShibbolethAttributeResolver.java:131) [shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:175) ~[shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.attribute.provider.ShibbolethSAML2AttributeAuthority.getAttributes(ShibbolethSAML2AttributeAuthority.java:59) ~[shibboleth-common-1.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.resolveAttributes(AbstractSAML2ProfileHandler.java:480) ~[shibboleth-identityprovider-2.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:307) ~[shibboleth-identityprovider-2.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:173) ~[shibboleth-identityprovider-2.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:90) ~[shibboleth-identityprovider-2.4.0.jar:na]
    at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:83) ~[shibboleth-common-1.4.0.jar:na]
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) ~[servlet-api-2.5.jar:na]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]
    at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) ~[shibboleth-identityprovider-2.4.0.jar:na]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]
    at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:87) ~[shibboleth-identityprovider-2.4.0.jar:na]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]
    at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) ~[shibboleth-common-1.4.0.jar:na]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293) ~[catalina-6.0.35.jar:6.0.35]
    at org.apache.jk.server.JkCoyoteHandler.invoke(JkCoyoteHandler.java:190) ~[tomcat-coyote-6.0.35.jar:6.0.35]
    at org.apache.jk.common.HandlerRequest.invoke(HandlerRequest.java:291) ~[tomcat-coyote-6.0.35.jar:6.0.35]
    at org.apache.jk.common.ChannelSocket.invoke(ChannelSocket.java:776) ~[tomcat-coyote-6.0.35.jar:6.0.35]
    at org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:705) ~[tomcat-coyote-6.0.35.jar:6.0.35]
    at org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:898) ~[tomcat-coyote-6.0.35.jar:6.0.35]
    at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690) ~[tomcat-coyote-6.0.35.jar:6.0.35]
    at java.lang.Thread.run(Thread.java:701) ~[na:1.6.0_27]
11:40:44.604 - WARN [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:484] - Error resolving attributes for principal 'user at DOMAIN.LOCAL'. No name identifier or attribute statement will be included in response

Any idea how to fix?

Thanks.

Regards,
Ricardo
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140227/2eb02863/attachment-0001.html