LDAP authentication, binding issue

[Val P]

Thank you, I did. However it didn't solve my issue. :(I also played with various representations of the user names, including full canonical representation. 
Does this give any hints?

2015-10-19 12:52:57,232 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:244] - resolve user=test at my.domain.com2015-10-19 12:52:57,232 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:310] - searchi ng for DN using userFilter
2015-10-19 12:52:57,234 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[or\g.ldaptive.SearchRequest at -1213229790::baseDn=cn=Users,DC=my,DC=domain,DC=com, searc\hFilter=[org.ldaptive.SearchFilter at -286285757::filter=(sAMAccountName={user}), parameter\s={user=test at my.domain.com}], returnAttributes=[1.1], searchScope=SUBTREE, timeLimi\t=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavio\r=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, foll\owReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.Defa\ultConnectionFactory$DefaultConnection at 1173117487::config=[org.ldaptive.ConnectionConfig\@1363981390::ldapUrl=ldap://idp.my.domain.com, connectTimeout=3000, responseTimeout=-\1, sslConfig=[org.ldaptive.ssl.SslConfig at 1454998072::credentialConfig=net.shibboleth.idp\.authn.impl.X509ResourceCredentialConfig at 4f5ac161, trustManagers=null, enabledCipherSuit\es=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStar\tTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provide\r.jndi.JndiConnectionFactory at 776225939::metadata=[ldapUrl=ldap://idp.my.domain.com, c\ount=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3\, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.lda\ptive.provider.jndi.JndiProviderConfig at 1477146338::operationExceptionResultCodes=[PROTOC\OL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.Connecti\onStrategies$DefaultConnectionStrategy at 60a0a322, controlProcessor=org.ldaptive.provider.\ControlProcessor at 4d308483, environment=null, tracePackets=null, removeDnUrls=true, searc\hIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocke\tFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.Jn\diConnection at 41dc316a]
2015-10-19 12:52:57,258 - DEBUG [org.ldaptive.provider.jndi.NamingExceptionUtils:358] - naming exception class javax.naming.NamingException is ambiguous, maps to multiple result codes: [OPERATIONS_ERROR, ALIAS_PROBLEM, ALIAS_DEREFERENCING_PROBLEM, LOOP_DETECT, AFFECTS_MULTIPLE_DSAS, OTHER]
2015-10-19 12:52:57,268 - WARN [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:212] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by test at my.domain.com produced exceptionorg.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580^@]; remaining name 'cn=Users,DC=my,DC=domain,DC=com'at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580^@]        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3175)2015-10-19 12:52:57,316 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual scheme, returning name of 'urn:federation:MicrosoftOnline'2015-10-19 12:52:57,318 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:787] - No UIInfo or logos returning null2015-10-19 12:52:57,318 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:529] - No description matching the languages found, returning null...

 


     On Saturday, October 17, 2015 6:16 AM, Peter Schober <peter.schober at univie.ac.at> wrote:
   

 * Val P <spamwall at redsigil.com> [2015-10-17 02:02]:
> What I don't understand is why it's not doing a bind. It did a bind
> during the service start, and it was succesful, but it then
> unbound. During authentication, it tries to do a search, but there
> is no new bind.

Can you try
  idp.authn.LDAP.authenticator = bindSearchAuthenticator
instead?
-peter
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151019/f77e5ce1/attachment.html>