How can I configure userFIlter login.config

[Daniel Fisher]

On Wed, Jun 4, 2014 at 1:13 PM, Teresa Fasano <t.fasano at cineca.it> wrote:
> Il 04/06/2014 18:58, David Gersic ha scritto:
>>>>> On 6/4/2014 at 11:48 AM, Teresa Fasano <t.fasano at cineca.it> wrote:
>>> Il 04/06/2014 18:39, David Gersic ha scritto:
>>>>>>> On 6/4/2014 at 11:30 AM, Teresa Fasano <t.fasano at cineca.it> wrote:
>>>>> Hi,
>>>>> I need to set the userFilter in the login.config with the attribute uid
>>>>> and the name of two objectClass.
>>>>>
>>>>> The filter in the ldapsearch is:
>>>>> ldapsearch -x -H ldap://LDAP-MY-SERVER:389-D 'cn=blah,blah,blah' -w
>>>>> 'xxxxxxxx'-b 'my-base-dn' -a never
>>>>> "(&(uid=user-test)(|(objectClass=name-of-class1)(objectClass=name-of-class2)))"
>>>>>
>>>>> How can I configure the filter
>>>>> "(&(uid=user-test)(|(objectClass=name-of-class1)(objectClass=name-of-class2)))"?
>>>>>
>>>>> I tried with
>>>>> userFilter="&(uid)(|(objectClass=name-of-class1)(objectClass=name-of-class2)))
>>>>> but I obtained:
>>>>>
>>>>> 18:22:04.616 - INFO
>>>>> [com.cineca.shibboleth.idp.provider.MultiLoginServlet:328] - The user
>>>>> identita.digitale cannot be authenticated
>>>>> javax.security.auth.login.LoginException:
>>>>> javax.naming.directory.InvalidSearchFilterException: Missing 'equals';
>>>>>
>>>>> Do you know how can I configure it?
>>>>>
>>>>> thanks,
>>>>> Teresa
>>>> The example configuration includes:
>>>>
>>>> userFilter="uid={0}";
>>>>
>>>> Your test configuration seems to be missing the "={0}" part of this, which
>>> could be what it's complaining about when it says: "Missing 'equals';"
>>>>
>>>>
>>>>
>>>> --
>>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>> OK, I have:
>>> edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
>>>                                   host="MY-LDAP-SERVER"
>>>                                   port="389"
>>>                                   serviceUser="cn=bla,bla,bla"
>>>                                   serviceCredential="*****"
>>>                                   base="MY-BASE-DN"
>>>                                   ssl="false"
>>>                                   tls="true"
>>>                                   subtreeSearch="true"
>>> userField="&(uid={0})(|(objectClass=name-of-class1)(objectClass=name-of-class2))"
>>>                                   derefAliases="never";
>>>
>>> Now, no syntax errors but the login fails because the user is not found
>>> using this information.
>>> While, with the ldapsearch the output is successful.
>>
>> I think you need one more level of parens to make a proper search filter.
>>
>> userField="(&(uid={0})(|(objectClass=name-of-class1)(objectClass=name-of-class2)))"
>
> I added the brackets as you suggest, but the login fails.

Note that the LdapLoginModule supports two distinct properties for
configuring the filter.

userField: a comma delimited string of attribute names that is used to
build a filter

userFilter: an LDAP filter string

Since you are specifying the filter, make sure you are using the
'userFilter' property.

--Daniel Fisher