Shib / ldap search base

[Farzan Qureshi]

Hi Dave,

Would you mind sharing your code in login.config that how you are defining
multiple search base?

I have to achieve same scenario.

Kind regards,

Farzan Qureshi
------------------
Network Administrator & Helpdesk support
Rosmini College

On 8/10/2014 6:53 AM, "Dave Vernon" <dvernon at loyalistcollege.com> wrote:

> Thanks Kevin,
>
> I missed the login.config file!  That's what I needed.  I've updated my
> files and things are working great.
>
> Dave Vernon
> Technology Infrastructure Specialist
> dvernon at loyalistc.on.ca
> loyalistcollege.com
>
>
>
>
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
> On Behalf Of Kevin Foote
> Sent: Tuesday, October 07, 2014 1:33 PM
> To: Shib Users
> Subject: Re: Shib / ldap search base
>
>
>
> On Oct 7, 2014, at 10:25 AM, Dave Vernon <dvernon at loyalistcollege.com>
> wrote:
>
> > Hello again,
> >
> > As you know, yesterday was an exciting day for me, getting my first
> Shibboleth project running in my dev environment.  My users are held in a
> Microsoft Active Directory (2008 R2 DC's, 2003 functional level).  I was
> aware that the default search base is CN=Users so I had put my test user
> there.
> >
> > Today I went to expand that and I've run into issues.  I'd like to be
> > able to search from the root of my AD dc=ad,dc=loyalistcollege,dc=ca ,
> > so I edited my attribute-resolver.xml file on my IdP, restarted the
> > service, and tested.  I found that it wasn't working - users NOT in
> > the cn=users container were rejected by Shib, and my test user in the
> > cn=users container was authenticated by Shib but rejected by the
> > resource I'm protecting (remote_user not set)
>
> ....
>
>
> And a snip from my idp-process.log
>
> javax.security.auth.login.LoginException: Cannot authenticate dn, invalid
> dn
>
>
> Dave,
>
> In the IdP authentication and resolving attributes are two different
> functions.
> Both are handled by the vt-ldap package but through different means..
> Recall during setup you configured authentication in the "login.config"
> file while you configured attribute resolution in the
> "attribute-resolver.xml" file
>
> --------
> thanks
>  kevin.foote
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>

-- 
This email and any files transmitted with it are confidential and intended 
solely for the use of the individual or entity to whom they are addressed. 
If you have received this email in error please notify the system manager (
admin at rosmini.school.nz). Please note that any views or opinions presented 
in this email are solely those of the author and do not necessarily 
represent those of the company. Finally, the recipient should check this 
email and any attachments for the presence of viruses. Rosmini College 
accepts no liability for any damage caused by any virus transmitted by this 
email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141008/21938f41/attachment-0001.html