authentication failure reasons in IdP logs

[David Bantz]

On Fri, 20 Jun 2014, at 06:34 , Daniel Fisher <dfisher at vt.edu> wrote:

> On Thu, Jun 19, 2014 at 6:09 PM, David Bantz <dabantz at alaska.edu> wrote:
>> 
>> Here’s an example from an apparently resourceful user who after one failure
>> tried again providing a different identifier; the two different identifiers
>> both correctly result in the same correct dn.
>> And in case you’re wondering, yes, both identifiers are correct and both
>> were validated by direct inspection of the AD record.
>> 
>> 12:32:23.457 - INFO [edu.vt.middleware.ldap.jaas.JaasAuthenticator:180] -
>> Authentication failed for dn:
>> CN=jlrosenthal,OU=userAccounts,dc=ua,dc=ad,dc=alaska,dc=edu
>> 12:32:23.460 - DEBUG
>> [edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet:176]
>> - User authentication for jlrosenthal failed
>> javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn
>> 
> 
> Are you certain those log messages were produced by the same thread?

They are adjacent lines in the idp-process.log.

> I'd like to see your login configuration, I'm confused as to what
> would produce this behavior.


ShibUserPassAuth {

// EDIR Auth
   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      ldapUrl="ldap://edir.alaska.edu:636"
      baseDn="ou=people,dc=alaska,dc=edu"
      bindDn="uid=shibboleth03,ou=resource,dc=alaska,dc=edu"
      bindCredential="shibboleth+20090303"
      ssl="true"
      tls="false"
      userField="uid,uasystemid,bannerid";

// UA AD Auth
   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      ldapUrl="ldap://fbk-adua02.ua.ad.alaska.edu:3268 ldap://fbk-adua03.ua.ad.alaska.edu:3268"
      baseDn="dc=ua,dc=ad,dc=alaska,dc=edu"
      bindDn="cn=uashib,ou=uaf_service,ou=uaf,dc=ua,dc=ad,dc=alaska,dc=edu"
      bindCredential="lkjhyuio87"
      subtreeSearch="true"
// Directly reference imported certificate for CA used to create/sign UA AD server certs 
      sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/UA_AD_CA.pem}"
      ssl="false"
      tls="true"
      userField="sAMAccountName,uaIdentifier";

// Example Kerberos authentication, requires Sun's JVM
// See: https://spaces.internet2.edu/display/SHIB2/IdPAuthUserPass
/*
   com.sun.security.auth.module.Krb5LoginModule required
      useKeyTab="true"
      keyTab="/path/to/idp/keytab/file";
*/

};
> 
> --Daniel Fisher
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140620/cf667d58/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140620/cf667d58/attachment.bin