Shib / ldap search base

[David Gersic]

I'm not using multiple search bases. For Shib, I have an LDAP directory where all objects are in OU=People so I don't need multiple search bases.


>>> On 10/7/2014 at 01:48 PM, Farzan Qureshi <fqureshi at rosmini.school.nz> wrote: 
> Hi Dave,
> 
> Would you mind sharing your code in login.config that how you are defining
> multiple search base?
> 
> I have to achieve same scenario.
> 
> Kind regards,
> 
> Farzan Qureshi
> ------------------
> Network Administrator & Helpdesk support
> Rosmini College
> 
> On 8/10/2014 6:53 AM, "Dave Vernon" <dvernon at loyalistcollege.com> wrote:
> 
>> Thanks Kevin,
>>
>> I missed the login.config file!  That's what I needed.  I've updated my
>> files and things are working great.
>>
>> Dave Vernon
>> Technology Infrastructure Specialist
>> dvernon at loyalistc.on.ca
>> loyalistcollege.com
>>
>>
>>
>>
>> -----Original Message-----
>> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
>> On Behalf Of Kevin Foote
>> Sent: Tuesday, October 07, 2014 1:33 PM
>> To: Shib Users
>> Subject: Re: Shib / ldap search base
>>
>>
>>
>> On Oct 7, 2014, at 10:25 AM, Dave Vernon <dvernon at loyalistcollege.com>
>> wrote:
>>
>> > Hello again,
>> >
>> > As you know, yesterday was an exciting day for me, getting my first
>> Shibboleth project running in my dev environment.  My users are held in a
>> Microsoft Active Directory (2008 R2 DC's, 2003 functional level).  I was
>> aware that the default search base is CN=Users so I had put my test user
>> there.
>> >
>> > Today I went to expand that and I've run into issues.  I'd like to be
>> > able to search from the root of my AD dc=ad,dc=loyalistcollege,dc=ca ,
>> > so I edited my attribute-resolver.xml file on my IdP, restarted the
>> > service, and tested.  I found that it wasn't working - users NOT in
>> > the cn=users container were rejected by Shib, and my test user in the
>> > cn=users container was authenticated by Shib but rejected by the
>> > resource I'm protecting (remote_user not set)
>>
>> ....
>>
>>
>> And a snip from my idp-process.log
>>
>> javax.security.auth.login.LoginException: Cannot authenticate dn, invalid
>> dn
>>
>>
>> Dave,
>>
>> In the IdP authentication and resolving attributes are two different
>> functions.
>> Both are handled by the vt-ldap package but through different means..
>> Recall during setup you configured authentication in the "login.config"
>> file while you configured attribute resolution in the
>> "attribute-resolver.xml" file
>>
>> --------
>> thanks
>>  kevin.foote
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
> 
> -- 
> This email and any files transmitted with it are confidential and intended 
> solely for the use of the individual or entity to whom they are addressed. 
> If you have received this email in error please notify the system manager (
> admin at rosmini.school.nz). Please note that any views or opinions presented 
> in this email are solely those of the author and do not necessarily 
> represent those of the company. Finally, the recipient should check this 
> email and any attachments for the presence of viruses. Rosmini College 
> accepts no liability for any damage caused by any virus transmitted by this 
> email.