Shib / ldap search base

[Kevin Foote]

On Oct 7, 2014, at 10:25 AM, Dave Vernon <dvernon at loyalistcollege.com> wrote:

> Hello again,
>  
> As you know, yesterday was an exciting day for me, getting my first Shibboleth project running in my dev environment.  My users are held in a Microsoft Active Directory (2008 R2 DC’s, 2003 functional level).  I was aware that the default search base is CN=Users so I had put my test user there.
>  
> Today I went to expand that and I’ve run into issues.  I’d like to be able to search from the root of my AD dc=ad,dc=loyalistcollege,dc=ca , so I edited my attribute-resolver.xml file on my IdP, restarted the service, and tested.  I found that it wasn’t working – users NOT in the cn=users container were rejected by Shib, and my test user in the cn=users container was authenticated by Shib but rejected by the resource I’m protecting (remote_user not set)

….


And a snip from my idp-process.log
 
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn


Dave, 

In the IdP authentication and resolving attributes are two different functions. 
Both are handled by the vt-ldap package but through different means.. 
Recall during setup you configured authentication in the “login.config” file while you configured 
attribute resolution in the “attribute-resolver.xml” file 

--------
thanks
 kevin.foote