LDAP Resolver not accepting BASEDN without OU?

[Daniel Fisher]

On Thu, Feb 27, 2014 at 7:03 AM, Ricardo Duarte <rjtd21 at hotmail.com> wrote:
> Hi there,
>
> I'm currently using Shibboleth with LDAP resolver, with the following
> config:
>
>
>     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>         ldapURL="ldap://dc.domain.local"
>         baseDN="ou=people,dc=domain,dc=local"
>         principal="cn=svc.ldap,cn=users,dc=domain,dc=local"
>         principalCredential="mypassword">
>         <resolver:Dependency ref="krb_principalname" />
>         <dc:FilterTemplate>
>             <![CDATA[
>
> (&(|(sAMAccountName=$requestContext.principalName)(userprincipalname=$requestContext.principalName))(objectclass=user))
>             ]]>
>         </dc:FilterTemplate>
>     </resolver:DataConnector>
>
> This is working fine.
>
> But If I set the baseDN to "dc=domain,dc=local", the attribute resolver no
> longer works.
> I know my svc.ldap is allowed to perform searches under that DN. I know the
> user I search exists.
>
> This is what is shown on the logs:

Post some logs for the edu.vt.middleware.ldap package. My first guess
would be you're having referral issues, but the logs should clarify.

--Daniel Fisher