openldap ACLs

[Holtom, Roger]

Hi, Martin,

Thanks for the info.  I do have a privileged account setup in both the LDAP connector in attribute-resolver.xml and in login.config, but no go unless I open up the ACLs on the directory.  I’ll keep digging, as I must have some poor syntax in one or both of these files.

Roger

On Mar 11, 2014, at 4:46 AM, Martin Haase <Martin.Haase at DAASI.de> wrote:

> Hi Roger,
> Am 10.03.2014 23:12, schrieb Holtom, Roger:
>> I’m trying to get a version 2.4.0 of IdP running.  I was having some issues when using sp.testship.org.  My directory is openldap 2.4.31 (I also have 2.4.36 running if that becomes a factor in my issue).  We have a number of ACLs in the openldap config, and the ldap error log indicated that these were the issue.  So on a test ldap I made all attributes readable by anonymous.  That allowed a successful test against testshib.org’s SP.  I’m sure I’m overlooking something (probably simple!),
> We usually use a service account specifically for the IdP in our
> OpenLDAP servers, plus pertaining ACLs for that account. For
> authentication (login.config) this is not necessarily needed (if you
> know and can construct the users' DNs beforehand, i.e. without a
> search), but for the attribute authority (attribute-resolver.xml), you
> do need such an account.
> Regards,
> Martin
>> and we do need to keep some of our attributes controlled as to who has access.  Any ideas on what I should be doing?
>> 
>> Roger Holtom
>> Systems Engineer, Directory Services
>> The University of Montana
>> roger.holtom at umontana.edu
>> 
>> 
>> 
>> 
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> -- 
> Dr. Martin Haase, Solutions Engineer
> 
> DAASI International GmbH        
> Europaplatz 3                   
> D-72072 Tübingen                
> Germany                    
> 
> phone: +49 7071 407109-6
> fax:   +49 7071 407109-9  
> email: martin.haase at daasi.de
> web:   www.daasi.de
> 
> Sitz der Gesellschaft: Tübingen
> Registergericht: Amtsgericht Stuttgart, HRB 382175
> Geschäftsleitung: Peter Gietz
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

Roger Holtom
roger.holtom at umontana.edu