Active Directory as Authentication Source

[David Gersic]

-b "" -s base is quite different from -b "cn=Users,dc=bucknell,dc=edu" however, so your test here isn't what your config is doing.



________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Michael Dahlberg <olgamirth at gmail.com>
Sent: Wednesday, March 04, 2015 2:13 PM
To: Shib Users
Subject: Re: Active Directory as Authentication Source



On Wed, Mar 4, 2015 at 2:27 PM, Daniel Fisher <dfisher at vt.edu<mailto:dfisher at vt.edu>> wrote:
On Wed, Mar 4, 2015 at 1:23 PM, Michael Dahlberg <olgamirth at gmail.com<mailto:olgamirth at gmail.com>> wrote:
Also, a final note: I've tried using ldapsearch with the given BaseDN and the BindDN as "serviceuser at bucknell.edu<mailto:serviceuser at bucknell.edu>" and am able to successfully query the AD database.

When you use ldapsearch, do you see 'ref:' values in the output? It could be that the err=32 that you're seeing is caused by a referral that the IDP is following when it performs DN resolution.


I ran the following command (removed some of the info that the Windows Admins rather I not put on a public list)

ldapsearch -x -D "servicename at bucknell.edu<mailto:servicename at bucknell.edu>" -b "" -s base -H ldap://XXXXX.bucknell.edu<http://XXXXX.bucknell.edu> -W

and received a long list various info about the AD database.  However, no referrals though.  I don't think that is the problem though, because I do include this

<dc:LDAPProperty name="java.naming.referral" value="follow"/>

in the attribute-resolver.xml file.

Thanks,
Mike


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150305/7e6ad795/attachment-0001.html