Active Directory as Authentication Source

[David Gersic]

Hm. Ok, a couple of things that are worth a look:


1. In login.config I don't think you want to have binddn or usercredentials. I'm also not sure that the trailing slash on the ldapUrl is a good idea, so:


   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://XXXXXX.bucknell.edu:389<http://XXXXXX.bucknell.edu:389/>"
      ssl="false"
      tls="false"
      baseDN="cn=Users,dc=bucknell,dc=edu"
      subtreeSearch="false"
      userFilter="cn={0}";


I'm not even sure I'd bother with the :389 on the ldapUrl line. That you're telling it to use ldap:// should be suffficient, I think. Mine are "ldaps://192.168.1.1" and "ssl=true" here, so I'm guessing on that.


2. In attribute-resolver.xml, you probably need to specify a DN for "principal", not a UPN. And same as above, I don't think you want the trailing slash, so:


    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://XXXXXX.bucknell.edu<http://XXXXXX.bucknell.edu/>"
        baseDN="cn=Users,dc=bucknell,dc=edu"
        principal="cn=servicename<mailto:servicename at bucknell.edu>,cn=users,dc=bucknell,dc=edu"
        principalCredential="XXXXXXXX">
        <dc:FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>employeeType uid cn sn displayName givenName mail bucknellEmployeeType memberOf bucknelleduPersonEntitlement</dc:ReturnAttributes>
        <dc:LDAPProperty name="java.naming.referral" value="follow"/>
    </resolver:DataConnector>


Probably. An equivalent ldapsearch for testing would be something like:


ldapsearch -x -LLL -H ldap://XXXXXX.bucknell.edu/<http://XXXXXX.bucknell.edu/> -D cn=servicename<mailto:servicename at bucknell.edu>,cn=users,dc=bucknell,dc=edu -W -b cn=Users,dc=bucknell,dc=edu '(samaccountname=bob)' employeeType uid cn sn displayName givenName mail bucknellEmployeeType memberOf bucknelleduPersonEntitlement


You'll need to specify a valid samaccountname, of course, unless you have something named "bob" to search for.



________________________________
From: users-bounces at shibboleth.net <users-bounces at shibboleth.net> on behalf of Michael Dahlberg <olgamirth at gmail.com>
Sent: Thursday, March 05, 2015 3:33 PM
To: Shib Users
Subject: Re: Active Directory as Authentication Source



On Thu, Mar 5, 2015 at 4:03 PM, David Gersic <dgersic at niu.edu<mailto:dgersic at niu.edu>> wrote:

It might help to post the actual configuration file you're using. Mask out the sensitive bits before posting, of course.

David:

No problem.  Just didn't think anybody would want to see that.  The entire non-commented-out part of login.conf is as follows:

ShibUserPassAuth {

   edu.vt.middleware.ldap.jaas.LdapLoginModule required
      ldapUrl="ldap://XXXXXX.bucknell.edu:389/<http://XXXXXX.bucknell.edu:389/>"
      ssl="false"
      tls="false"
      baseDN="cn=Users,dc=bucknell,dc=edu"
      subtreeSearch="false"
      bindDn="servicename at bucknell.edu<mailto:servicename at bucknell.edu>"
      bindCredential="XXXXXXX"
      userFilter="cn={0}";

};

The LDAP connector in the attribute-resolver.xml file:

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://XXXXXX.bucknell.edu/<http://XXXXXX.bucknell.edu/>"
        baseDN="cn=Users,dc=bucknell,dc=edu"
        principal="servicename at bucknell.edu<mailto:servicename at bucknell.edu>"
        principalCredential="XXXXXXXX">
        <dc:FilterTemplate>
            <![CDATA[
                (sAMAccountName=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>employeeType uid cn sn displayName givenName mail bucknellEmployeeType memberOf bucknelleduPersonEntitlement</dc:ReturnAttributes>
        <dc:LDAPProperty name="java.naming.referral" value="follow"/>
    </resolver:DataConnector>


And this is the login handler portion of handler.xml


    <ph:LoginHandler xsi:type="ph:UsernamePassword"
                  jaasConfigurationLocation="file:///usr/local/idp/conf/login.config">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
    </ph:LoginHandler>

    <ph:LoginHandler xsi:type="ph:PreviousSession">
        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:AuthenticationMethod>
    </ph:LoginHandler>


It all seems pretty standard which is why I am so confused as to why it's not working.

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150305/14a77959/attachment-0001.html