Shib / ldap search base

[Dave Vernon]

Absolutely!

This is my login.config


   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      host="horus.ADS.LOYALISTCOLLEGE.CA"
      port="3268"
      base="DC=ads,DC=loyalistcollege,DC=ca"
      tls="false"
      serviceCredential="removed from post”
      userRoleAttribute="sAMAccountName"
      serviceUser="ldapqsvc at ads.loyalistcollege.ca"
      subtreeSearch = "true"
      userField="samAccountName";



(Where “horus” is a global catalog)


And then in addition my attribute-resolver is set to match

    <resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        useStartTLS="false"
        ldapURL="ldap://horus.ADS.LOYALISTCOLLEGE.CA:3268" baseDN="DC=ads,DC=loyalistcollege,DC=ca" principal="ldapqsvc at ads.loyalistcollege.ca"
        principalCredential="removed from post">
        <FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </FilterTemplate>

        <!-- We rely on the uniqueness of the objectSid.  But it is binary so we *must* make it so -->
        <LDAPProperty name="java.naming.ldap.attributes.binary" value="objectSid"/>
        <!-- If we are following from the GC we need thus on -->
        <LDAPProperty name="java.naming.referral" value="follow"/>

    </resolver:DataConnector>



Once I made those changes, and restarted the service, I am able to login with any users in my AD domain, regardless of where the user is.

Dave Vernon
Technology Infrastructure Specialist
dvernon at loyalistc.on.ca<mailto:dvernon at loyalistc.on.ca>
loyalistcollege.com<http://loyalistcollege.com/>

[Loyalist College]<http://www.loyalistcollege.com/>[Facebook]<https://www.facebook.com/loyalistcollege>[Twitter]<https://twitter.com/loyalistcollege>

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Farzan Qureshi
Sent: Tuesday, October 07, 2014 2:48 PM
To: Shib Users
Subject: RE: Shib / ldap search base


Hi Dave,

Would you mind sharing your code in login.config that how you are defining multiple search base?

I have to achieve same scenario.

Kind regards,

Farzan Qureshi
------------------
Network Administrator & Helpdesk support
Rosmini College

On 8/10/2014 6:53 AM, "Dave Vernon" <dvernon at loyalistcollege.com<mailto:dvernon at loyalistcollege.com>> wrote:
Thanks Kevin,

I missed the login.config file!  That's what I needed.  I've updated my files and things are working great.

Dave Vernon
Technology Infrastructure Specialist
dvernon at loyalistc.on.ca<mailto:dvernon at loyalistc.on.ca>
loyalistcollege.com<http://loyalistcollege.com>




-----Original Message-----
From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>] On Behalf Of Kevin Foote
Sent: Tuesday, October 07, 2014 1:33 PM
To: Shib Users
Subject: Re: Shib / ldap search base



On Oct 7, 2014, at 10:25 AM, Dave Vernon <dvernon at loyalistcollege.com<mailto:dvernon at loyalistcollege.com>> wrote:

> Hello again,
>
> As you know, yesterday was an exciting day for me, getting my first Shibboleth project running in my dev environment.  My users are held in a Microsoft Active Directory (2008 R2 DC's, 2003 functional level).  I was aware that the default search base is CN=Users so I had put my test user there.
>
> Today I went to expand that and I've run into issues.  I'd like to be
> able to search from the root of my AD dc=ad,dc=loyalistcollege,dc=ca ,
> so I edited my attribute-resolver.xml file on my IdP, restarted the
> service, and tested.  I found that it wasn't working - users NOT in
> the cn=users container were rejected by Shib, and my test user in the
> cn=users container was authenticated by Shib but rejected by the
> resource I'm protecting (remote_user not set)

....


And a snip from my idp-process.log

javax.security.auth.login.LoginException: Cannot authenticate dn, invalid dn


Dave,

In the IdP authentication and resolving attributes are two different functions.
Both are handled by the vt-ldap package but through different means..
Recall during setup you configured authentication in the "login.config" file while you configured attribute resolution in the "attribute-resolver.xml" file

--------
thanks
 kevin.foote

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager (admin at rosmini.school.nz<mailto:admin at rosmini.school.nz>). Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company. Finally, the recipient should check this email and any attachments for the presence of viruses. Rosmini College accepts no liability for any damage caused by any virus transmitted by this email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141007/b5c33de4/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 4005 bytes
Desc: image001.png
Url : http://shibboleth.net/pipermail/users/attachments/20141007/b5c33de4/attachment-0003.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 1476 bytes
Desc: image002.png
Url : http://shibboleth.net/pipermail/users/attachments/20141007/b5c33de4/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 1536 bytes
Desc: image003.png
Url : http://shibboleth.net/pipermail/users/attachments/20141007/b5c33de4/attachment-0005.png