Shib / ldap search base

[Dave Vernon]

Thanks Kevin,

I missed the login.config file!  That's what I needed.  I've updated my files and things are working great.

Dave Vernon
Technology Infrastructure Specialist
dvernon at loyalistc.on.ca
loyalistcollege.com




-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin Foote
Sent: Tuesday, October 07, 2014 1:33 PM
To: Shib Users
Subject: Re: Shib / ldap search base



On Oct 7, 2014, at 10:25 AM, Dave Vernon <dvernon at loyalistcollege.com> wrote:

> Hello again,
>  
> As you know, yesterday was an exciting day for me, getting my first Shibboleth project running in my dev environment.  My users are held in a Microsoft Active Directory (2008 R2 DC's, 2003 functional level).  I was aware that the default search base is CN=Users so I had put my test user there.
>  
> Today I went to expand that and I've run into issues.  I'd like to be 
> able to search from the root of my AD dc=ad,dc=loyalistcollege,dc=ca , 
> so I edited my attribute-resolver.xml file on my IdP, restarted the 
> service, and tested.  I found that it wasn't working - users NOT in 
> the cn=users container were rejected by Shib, and my test user in the 
> cn=users container was authenticated by Shib but rejected by the 
> resource I'm protecting (remote_user not set)

....


And a snip from my idp-process.log
 
javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn


Dave, 

In the IdP authentication and resolving attributes are two different functions. 
Both are handled by the vt-ldap package but through different means.. 
Recall during setup you configured authentication in the "login.config" file while you configured attribute resolution in the "attribute-resolver.xml" file 

--------
thanks
 kevin.foote

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net