LDAP authentication, binding issue

[Douglas E Engert]

ldapUrl=ldap://idp.my.domain.com

Are you trying to use the AD LDAP?
Based on the filter, you want to use ldap://my.domain.com

The message:
Not a usual scheme, returning name of 'urn:federation:MicrosoftOnline'
implies:
https://msdn.microsoft.com/en-us/library/azure/dn641269.aspx


On 10/19/2015 12:00 PM, Val P wrote:
> Thank you, I did. However it didn't solve my issue. :(
> I also played with various representations of the user names, including full canonical representation.
>
> Does this give any hints?
>
>
> 2015-10-19 12:52:57,232 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:244] - resolve user=test at my.domain.com
> 2015-10-19 12:52:57,232 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:310] - searchi ng for DN using userFilter
>
> 2015-10-19 12:52:57,234 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[or\
> g.ldaptive.SearchRequest at -1213229790::baseDn=cn=Users,DC=my,DC=domain,DC=com, searc\
> hFilter=[org.ldaptive.SearchFilter at -286285757::filter=(sAMAccountName={user}), parameter\
> s={user=test at my.domain.com}], returnAttributes=[1.1], searchScope=SUBTREE, timeLimi\
> t=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavio\
> r=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, foll\
> owReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.Defa\
> ultConnectionFactory$DefaultConnection at 1173117487::config=[org.ldaptive.ConnectionConfig\
> @1363981390::ldapUrl=ldap://idp.my.domain.com, connectTimeout=3000, responseTimeout=-\
> 1, sslConfig=[org.ldaptive.ssl.SslConfig at 1454998072::credentialConfig=net.shibboleth.idp\
> .authn.impl.X509ResourceCredentialConfig at 4f5ac161, trustManagers=null, enabledCipherSuit\
> es=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStar\
> tTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provide\
> r.jndi.JndiConnectionFactory at 776225939::metadata=[ldapUrl=ldap://idp.my.domain.com, c\
> ount=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3\
> , java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.lda\
> ptive.provider.jndi.JndiProviderConfig at 1477146338::operationExceptionResultCodes=[PROTOC\
> OL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.Connecti\
> onStrategies$DefaultConnectionStrategy at 60a0a322, controlProcessor=org.ldaptive.provider.\
> ControlProcessor at 4d308483, environment=null, tracePackets=null, removeDnUrls=true, searc\
> hIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocke\
> tFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.Jn\
> diConnection at 41dc316a]
>
> 2015-10-19 12:52:57,258 - DEBUG [org.ldaptive.provider.jndi.NamingExceptionUtils:358] - naming exception class javax.naming.NamingException is ambiguous,
> maps to multiple result codes: [OPERATIONS_ERROR, ALIAS_PROBLEM, ALIAS_DEREFERENCING_PROBLEM, LOOP_DETECT, AFFECTS_MULTIPLE_DSAS, OTHER]
>
> 2015-10-19 12:52:57,268 - WARN [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:212]
> - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by test at my.domain.com produced exception
> org.ldaptive.LdapException: javax.naming.NamingException: [LDAP: error code 1 - 000004DC:
> LdapErr: DSID-0C09072B, comment: In order to perform this operation a successful bind
> must be completed on the connection., data 0, v2580^@]; remaining name 'cn=Users,DC=my,DC=domain,DC=com'
> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)
> Caused by: javax.naming.NamingException: [LDAP: error code 1 - 000004DC: LdapErr: DSID-0C09072B,
> comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580^@]
>          at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3175)
> 2015-10-19 12:52:57,316 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:363] - Not a usual scheme, returning name of 'urn:federation:MicrosoftOnline'
> 2015-10-19 12:52:57,318 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:787] - No UIInfo or logos returning null
> 2015-10-19 12:52:57,318 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:529] - No description matching the languages found, returning null
> ...
>
>
>
>
>
> On Saturday, October 17, 2015 6:16 AM, Peter Schober <peter.schober at univie.ac.at> wrote:
>
>
> * Val P <spamwall at redsigil.com <mailto:spamwall at redsigil.com>> [2015-10-17 02:02]:
>  > What I don't understand is why it's not doing a bind. It did a bind
>  > during the service start, and it was succesful, but it then
>  > unbound. During authentication, it tries to do a search, but there
>  > is no new bind.
>
> Can you try
>    idp.authn.LDAP.authenticator = bindSearchAuthenticator
> instead?
> -peter
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
>
>
>
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>