LDAP authentication, binding issue

[Daniel Fisher]

On Mon, Oct 19, 2015 at 1:00 PM, Val P <spamwall at redsigil.com> wrote:

> Thank you, I did. However it didn't solve my issue. :(
> I also played with various representations of the user names, including
> full canonical representation.
>
> Does this give any hints?
>
>
> 2015-10-19 12:52:57,232 - DEBUG
> [org.ldaptive.auth.PooledSearchDnResolver:244] - resolve user=
> test at my.domain.com
> 2015-10-19 12:52:57,232 - DEBUG
> [org.ldaptive.auth.PooledSearchDnResolver:310] - searchi ng for DN using
> userFilter
>


What is the value of idp.authn.LDAP.authenticator? Your first post
indicates you're using adAuthenticator, which would not perform a search
for the DN.


>
> 2015-10-19 12:52:57,268 - WARN
> [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:212]
> - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
> test at my.domain.com produced exception
> org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error
> code 1 - 000004DC:
> LdapErr: DSID-0C09072B, comment: In order to perform this operation a
> successful bind
> must be completed on the connection., data 0, v2580^@]; remaining name
> 'cn=Users,DC=my,DC=domain,DC=com'
> at
> org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)
> Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC:
> LdapErr: DSID-0C09072B,
> comment: In order to perform this operation a successful bind must be
> completed on the connection., data 0, v2580^@]
>         at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3175)
>

This look like more evidence that your value for
idp.authn.LDAP.authenticator isn't being honored. You would see this sort
of problem if you're using the anonSearchAuthenticator, your connection
pool is full of unauthenticated connections.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151019/5c9758fa/attachment.html>