Active Directory as Authentication Source

[Michael Dahlberg]

I'm attempting to reconfigure our Shibboleth IdP (ver. 2.4.3, soon 2.4.4)
to use our Active Directory service as the authentication source.  We're
currently using CAS, which itself uses AD.

As described in many tutorials, after a generic shib install, I've modified
the login.config and the handler.xml files.  Most of these tutorials seem
to treat AD as analogous to LDAP authentication.  With the login.config
file, I've included the ldapUrl on the unencrypted port, disabled
encryption, and included the service user for authenticated binds.  With
the handler.xml file, I've commented out the RemoteUser and ExternalAuthn
handlers and enabled the UsernamePassword handler.

I then tried to test the IdP using testshib.org's SP and was unable to
authenticate.  I keep getting the error:

14:04:24.090 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:164] -
Error occured attempting authentication
javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D:
NameErr: DSID-031001E5, problem 2001 (NO_OBJECT), data 0, best match of:
        ''

>From the perspective of the AD server, the initial authenticated bind (to
determine if the username is valid) takes place and succeeds but the IdP
never submits the next request to authenticate the specific user.  As such,
no data is received from the AD server for the user that needs to be
authenticated.

I have three questions:

(1) Any suggestions on why the authentication phase is not completed?

(2) Should I be looking at treating authentication to an AD server more
like a Kerberos authentication scheme rather than an LDAP type scheme.

And finally
(3) Ultimately, I'd like to test this against all of the SPs that we work
with.  To do that, I've replicated our production server's metadata on this
server.  I then modify the client browser's /etc/hosts file so that the
name of production Shibboleth server has the IP address of the test
Shibboleth server.  Is this the way most IdP sites test changes in their
configuration before they put them into production?

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150304/bae58351/attachment.html