v3 AD setup

[Ower All]

Hello.  We have it set up in the ldap.properties to what you said below. "idp.authn.LDAP.bindDN                           = CN=shib_test_acct,OU=test,OU=dc,DC=com. 
1) Do we need quotes around it?2) Are spaces allowed such as OU=test ou?
Unfortunately, we are still getting this error. Any help would be great. 

To recap what we did.1) we added the dc info to ldap.properties2) we added the dc info to jaas.config

I'm not sure if they are both required for active directory.
Thank you.
 


     On Friday, October 30, 2015 4:05 PM, Brian Biggs <brian.biggs at sonoma.edu> wrote:
   

  For one thing, your idp.authn.LDAP.bindDN is definitely wrong.
 Should be more like "cn=bind_account_name,ou=test,dc=domain,dc=com"
 
 -Brian
 
 On 10/30/2015 12:57 PM, Ower All wrote:
  
 
 Thank you peter. We have decided to try JAAS since we could not get it working this way. Has anyone seen this error before? 
  2015-10-30 15:40:58,646 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request
 org.opensaml.messaging.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message
         atorg.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:73)
 2015-10-30 15:48:24,012 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by testuser failed
 javax.security.auth.login.LoginException: Authentication failed: [org.ldaptive.auth.AuthenticationResponse at 1542122009::authenticationResultCode=DN_RESOLUTION_FAILURE, ldapEntry=null, accountState=null, result=false, resultCode=null, message=DN cannot be null, controls=null]
         at org.ldaptive.jaas.LdapLoginModule.login(LdapLoginModule.java:160) 
  We edited JAAS.config with our information. Thank you
  
   
 
 
       On Thursday, October 29, 2015 3:15 PM, Peter Schober <peter.schober at univie.ac.at> wrote:
   
 
 First of all, you're missing an error description.
 
 * Ower All <owerall at yahoo.com> [2015-10-29 19:24]:
 > idp.authn.LDAP.ldapURL                           = ldaps://test.domain.com (do I need a port # here?)
 > #idp.authn.LDAP.useStartTLS                   = true
 > #idp.authn.LDAP.useSSL                          = false
 > #idp.authn.LDAP.connectTimeout             = 3000
 > #idp.authn.LDAP.sslConfig                       = jvmTrust
 > idp.authn.LDAP.baseDN                            = ou=test,dc=domain,dc=com
 > #idp.authn.LDAP.subtreeSearch                = false
 > idp.authn.LDAP.bindDN                              = testacct at test.domain.com
 > idp.authn.LDAP.bindDNCredential                 = *****  
 
 As per
 https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration
 the parameter idp.authn.LDAP.useStartTLS defaults to true (which will
 be active if you leave it commented out), which won't work when you're
 connecting with an ldapURL of ldaps.
 So next I'd uncomment idp.authn.LDAP.useStartTLS and set it to false.
 
 Then your ldapURL is ldaps (implying useSSL, to me) but the default of
 idp.authn.LDAP.useSSL=false is active. No idea what the libraries will
 do in such a case, but it doesn't make much sense.
 
 To what port you should connect is up to your deployment, we can't
 tell you. The libraries will pick the IANA-defined standard port from
 the ldapURL, I'd expect. So once the scheme in the ldapURL is correct
 you'd only have to add a port if you're not connecting to the
 IANA-defined standard ports, but e.g. to MS-AD's "global catalog"
 (AFAIK). In short: ask your MS-AD admins.
 
 There's also a section on MS-AD in the documentation.
 https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration
 
 -peter
 -- 
 To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
 
      
  
 
 -- 

Brian Biggs
Sonoma State University
 
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151102/c27f4d50/attachment-0001.html>