error in attribute resolver after upgraded to IDP 3.0

[Hong Ye]

ok. That’s the problem in our AD when using uid in FilterTemplate. But I can’t figure out why I got runtime exception when using cn in FilterTemplate.

Thanks, Hong
On Jan 16, 2015, at 12:20 PM, hy93 <hy93 at cornell.edu<mailto:hy93 at cornell.edu>> wrote:

Thanks Scott. Another problem:

Now the data connector to AD doesn’t work. If cn is used in FilterTemplate, I got runtime exception when ran aacli.sh. If I replaced cn with UID, I didn’t see any error in the log, but I didn’t get requested data back.

2015-01-16 11:48:41,260 - ERROR [net.shibboleth.idp.profile:-2] - Uncaught runtime exception
net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Attribute value cannot be null or empty
        at net.shibboleth.utilities.java.support.logic.Constraint.isNotNull(Constraint.java:210)

Attribute-resolver.xml
   <resolver:AttributeDefinition id="mail" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                              xsi:type="Simple"
                              sourceAttributeID="mail">

        <resolver:Dependency ref="myAD" />
        <resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder"
                               name="urn:oid:0.9.2342.19200300.100.1.3"
                               friendlyName="mail" />

    </resolver:AttributeDefinition>

 <resolver:DataConnector id="myAD" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
           ldapURL="ldap://query.ad.cornell.edu:3268"

        baseDN="DC=cornell,DC=edu"
        principal=“xxxxx"
        principalCredential=“xxx" >
        <FilterTemplate>
            <![CDATA[
                (cn=$requestContext.principalName)
            ]]>
        </FilterTemplate>
       <LDAPProperty name="java.naming.referral" value="follow"/>
  </resolver:DataConnector>

Thanks,
Hong

On Jan 14, 2015, at 2:25 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 1/14/15, 7:12 PM, "Hong Ye" <hy93 at cornell.edu<mailto:hy93 at cornell.edu>> wrote:



I also see this warning in the log. The warning was generated when I
restarted Tomcat. I don’t understand what it mean.

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPJava1.8

Has nothing to do with the IdP version.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150116/e778b3b4/attachment-0001.html