Shib / ldap search base

Tue Oct 7 19:15:56 EDT 2014

Hi Dave Vernon,

Thanks for the detailed response. Actually I was thinking you are querying
multiple base DNs. Actually I don't want to use top level AD forest. I want
to keep it restricted to three or four OUs. But I believe in your case you
are using top level base DN and not multiple search base.

I would be glad if someone in the community is using multiple search base.

Thanks for your help :-)

And thanks David for your response.

Kind regards,
Farzan

On 8 October 2014 07:55, Dave Vernon <dvernon at loyalistcollege.com> wrote:

>  Absolutely!
>
>
>
> This is my login.config
>
>
>
>
>
>    edu.vt.middleware.ldap.jaas.LdapLoginModule required
>
>       host="horus.ADS.LOYALISTCOLLEGE.CA"
>
>       port="3268"
>
>       base="DC=ads,DC=loyalistcollege,DC=ca"
>
>       tls="false"
>
>       serviceCredential="removed from post”
>
>       userRoleAttribute="sAMAccountName"
>
>       serviceUser="ldapqsvc at ads.loyalistcollege.ca"
>
>       subtreeSearch = "true"
>
>       userField="samAccountName";
>
>
>
>
>
>
>
> (Where “horus” is a global catalog)
>
>
>
>
>
> And then in addition my attribute-resolver is set to match
>
>
>
>     <resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory"
> xmlns="urn:mace:shibboleth:2.0:resolver:dc"
>
>         useStartTLS="false"
>
>         ldapURL="ldap://horus.ADS.LOYALISTCOLLEGE.CA:3268"
> baseDN="DC=ads,DC=loyalistcollege,DC=ca" principal="
> ldapqsvc at ads.loyalistcollege.ca"
>
>         principalCredential="removed from post">
>
>         <FilterTemplate>
>
>             <![CDATA[
>
>                 (sAMAccountName=$requestContext.principalName)
>
>             ]]>
>
>         </FilterTemplate>
>
>
>
>         <!-- We rely on the uniqueness of the objectSid.  But it is binary
> so we *must* make it so -->
>
>         <LDAPProperty name="java.naming.ldap.attributes.binary"
> value="objectSid"/>
>
>         <!-- If we are following from the GC we need thus on -->
>
>         <LDAPProperty name="java.naming.referral" value="follow"/>
>
>
>
>     </resolver:DataConnector>
>
>
>
>
>
>
>
> Once I made those changes, and restarted the service, I am able to login
> with any users in my AD domain, regardless of where the user is.
>
>
>
> *Dave Vernon*
>
> *Technology Infrastructure Specialist*
>
> dvernon at loyalistc.on.ca
>
> loyalistcollege.com
>
>
>
> [image: Loyalist College] <http://www.loyalistcollege.com/>[image:
> Facebook] <https://www.facebook.com/loyalistcollege>[image: Twitter]
> <https://twitter.com/loyalistcollege>
>
>
>
> *From:* users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
> *On Behalf Of *Farzan Qureshi
> *Sent:* Tuesday, October 07, 2014 2:48 PM
> *To:* Shib Users
> *Subject:* RE: Shib / ldap search base
>
>
>
> Hi Dave,
>
> Would you mind sharing your code in login.config that how you are defining
> multiple search base?
>
> I have to achieve same scenario.
>
> Kind regards,
>
> Farzan Qureshi
> ------------------
> Network Administrator & Helpdesk support
> Rosmini College
>
>
> On 8/10/2014 6:53 AM, "Dave Vernon" <dvernon at loyalistcollege.com> wrote:
>
> Thanks Kevin,
>
> I missed the login.config file!  That's what I needed.  I've updated my
> files and things are working great.
>
> Dave Vernon
> Technology Infrastructure Specialist
> dvernon at loyalistc.on.ca
> loyalistcollege.com
>
>
>
>
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net]
> On Behalf Of Kevin Foote
> Sent: Tuesday, October 07, 2014 1:33 PM
> To: Shib Users
> Subject: Re: Shib / ldap search base
>
>
>
> On Oct 7, 2014, at 10:25 AM, Dave Vernon <dvernon at loyalistcollege.com>
> wrote:
>
> > Hello again,
> >
> > As you know, yesterday was an exciting day for me, getting my first
> Shibboleth project running in my dev environment.  My users are held in a
> Microsoft Active Directory (2008 R2 DC's, 2003 functional level).  I was
> aware that the default search base is CN=Users so I had put my test user
> there.
> >
> > Today I went to expand that and I've run into issues.  I'd like to be
> > able to search from the root of my AD dc=ad,dc=loyalistcollege,dc=ca ,
> > so I edited my attribute-resolver.xml file on my IdP, restarted the
> > service, and tested.  I found that it wasn't working - users NOT in
> > the cn=users container were rejected by Shib, and my test user in the
> > cn=users container was authenticated by Shib but rejected by the
> > resource I'm protecting (remote_user not set)
>
> ....
>
>
> And a snip from my idp-process.log
>
> javax.security.auth.login.LoginException: Cannot authenticate dn, invalid
> dn
>
>
> Dave,
>
> In the IdP authentication and resolving attributes are two different
> functions.
> Both are handled by the vt-ldap package but through different means..
> Recall during setup you configured authentication in the "login.config"
> file while you configured attribute resolution in the
> "attribute-resolver.xml" file
>
> --------
> thanks
>  kevin.foote
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> This email and any files transmitted with it are confidential and intended
> solely for the use of the individual or entity to whom they are addressed.
> If you have received this email in error please notify the system manager (*admin at rosmini.school.nz
> <admin at rosmini.school.nz>*). Please note that any views or opinions
> presented in this email are solely those of the author and do not
> necessarily represent those of the company. Finally, the recipient should
> check this email and any attachments for the presence of viruses. *Rosmini
> College* accepts no liability for any damage caused by any virus
> transmitted by this email.
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>

-- 
*Farzan Qureshi* | Network Administrator & Help-desk Support | Rosmini
College | (09) 487 0 530

-- 
This email and any files transmitted with it are confidential and intended 
solely for the use of the individual or entity to whom they are addressed. 
If you have received this email in error please notify the system manager (
admin at rosmini.school.nz). Please note that any views or opinions presented 
in this email are solely those of the author and do not necessarily 
represent those of the company. Finally, the recipient should check this 
email and any attachments for the presence of viruses. Rosmini College 
accepts no liability for any damage caused by any virus transmitted by this 
email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141008/55a3f304/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 1476 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20141008/55a3f304/attachment-0003.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 4005 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20141008/55a3f304/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 1536 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20141008/55a3f304/attachment-0005.png 