I'd like a hint regarding ldap.properties

[Cantor, Scott]

On 4/30/15, 12:56 PM, "Joe Edwards" <joee at uw.edu> wrote:
>
>I figure that others use the domain\samaccountname to bind.
>And that the solution is straight forward.

That's not really all that common. Personally if I could do that direct bind, I'd just use Kerberos instead and leave the LDAP part to attribute lookup only.

>How do I see what parameters are being sent to the ad server?

I don't know that every last parameter is logged, but the ldaptive code logs plenty of stuff if it's told to.

This is right in the log config:

<!-- Logs LDAP related messages -->
    <logger name="org.ldaptive" level="WARN"/>

If you need more, turn that up.


>I turned up debugging so that I could see what was happening.
>How do I know if the username is testad\joeee not joeee?

I'm fairly sure ldaptive will log what it's binding with.

>Also, I tried an invalid user - joeee.
>The password was invalid too, the log message. imo,
>should state something like ("525",  "user not found").

I would think it would....

>2015-04-30 09:16:25,688 - DEBUG 
>[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:175] - 
>Profile Action ValidateUsernamePasswordAgainstLDAP: Attempting to 
>authenticate user joeee
>2015-04-30 09:16:25,715 - DEBUG 
>[org.springframework.webflow.execution.ActionExecutor:53] - Finished 
>executing 
>net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP at 1571f7ba; 
>result = InvalidPassword

I'm looking at the code right now and I can tell you that there would be plenty of additional detail logged. So I don't know what you're doing yet, but that ain't what's in the code as far as logging. The DEBUG statement there is followed up by any of a number of different log lines long before it exits out and ever gets back to the point of logging that event result. It's possible it's crashing in some weird way I guess and never makes it to the logging steps.

>P.S. I am using the jaas loginModule now, works fine, as far as I know....
>      I am adding the ad authentication.

If JAAS works, then it's a matter of not setting the properties quite correctly to this point.

-- Scott