Active Directory as Authentication Source

[Douglas E Engert]

On 3/5/2015 3:33 PM, Michael Dahlberg wrote:
>
>
> On Thu, Mar 5, 2015 at 4:03 PM, David Gersic <dgersic at niu.edu <mailto:dgersic at niu.edu>> wrote:
>
>     It might help to post the actual configuration file you're using. Mask out the sensitive bits before posting, of course.
>
>
> David:
>
> No problem.  Just didn't think anybody would want to see that.  The entire non-commented-out part of login.conf is as follows:
>
> ShibUserPassAuth {
>
>     edu.vt.middleware.ldap.jaas.LdapLoginModule required
>        ldapUrl="ldap://XXXXXX.bucknell.edu:389/"
>        ssl="false"
>        tls="false"
>        baseDN="cn=Users,dc=bucknell,dc=edu"
>        subtreeSearch="false"
>        bindDn="servicename at bucknell.edu"
>        bindCredential="XXXXXXX"
>        userFilter="cn={0}";
>
> };

JAAS has a debug="true" option that is very helpful.

Your user filter should have (). A better filter for AD would be:
   userFilter="(sAMAccountName={0})"

It could also be the bindDN you are using does not have read authority to the user's entry.

I believe your example above does not really authenticate the user, because you are using the bindDN, and bindCredential
to search for the user. What you want for LDAP authentication is to let edu.vt.middleware.ldap.jaas.LdapLoginModule
use the user and password provided to the JAAS. What you are doing is similar to the the second example in:

   https://code.google.com/p/vt-middleware/wiki/vtldapJAAS

where you want to check some attributes about the user.

Do you have an AD forest? i.e. sub domains?
If so are the users all in the top level domain under cn=users,dc=...?


>
> The LDAP connector in the attribute-resolver.xml file:
>
>      <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>          ldapURL="ldap://XXXXXX.bucknell.edu/"
>          baseDN="cn=Users,dc=bucknell,dc=edu"
>          principal="servicename at bucknell.edu"
>          principalCredential="XXXXXXXX">
>          <dc:FilterTemplate>
>              <![CDATA[
>                  (sAMAccountName=$requestContext.principalName)
>              ]]>
>          </dc:FilterTemplate>
>          <dc:ReturnAttributes>employeeType uid cn sn displayName givenName mail bucknellEmployeeType memberOf bucknelleduPersonEntitlement</dc:ReturnAttributes>
>          <dc:LDAPProperty name="java.naming.referral" value="follow"/>
>      </resolver:DataConnector>
>
>
> And this is the login handler portion of handler.xml
>
>
>      <ph:LoginHandler xsi:type="ph:UsernamePassword"
>                    jaasConfigurationLocation="file:///usr/local/idp/conf/login.config">
>          <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
>      </ph:LoginHandler>
>
>      <ph:LoginHandler xsi:type="ph:PreviousSession">
>          <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:AuthenticationMethod>
>      </ph:LoginHandler>
>
>
> It all seems pretty standard which is why I am so confused as to why it's not working.
>
> Thanks,
> Mike
>
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>