LDAP authentication, binding issue

Val P spamwall at redsigil.com
Mon Oct 19 23:35:58 EDT 2015 

Thank you. I feel a bit dumb. Or old. ;)  That was indeed it.
I made a little more progress, and I can now fully authenticate with ldap. I am trying to work on Office 365 integration, but I am getting an "The application you have accessed is not registered for use with this service." error after authentication.In reviewing the list archives, it looks like it has to do with metadata not loaded, but I'm not sure what it really means. My logs show the following:
My metadata.xml is: <MetadataProvider id="MicrosoftOnline"                      xsi:type="FileBackedHTTPMetadataProvider"                      backingFile="%{idp.home}/metadata/federationmetadata.xml"                      metadataURL="https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml">        <MetadataFilter xsi:type="EntityRoleWhiteList">            <RetainedRole>md:SPSSODescriptor</RetainedRole>        </MetadataFilter> </MetadataProvider>
and I have the metadata in my $idp.home/metadata folder as well.
The metadata gets loaded:
2015-10-19 23:24:14,790 - DEBUG [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:225] - Attempting to fetch metadata document from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,476 - DEBUG [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:343] - Attempting to extract metadata from response to request for metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,481 - DEBUG [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:245] - Successfully fetched 17977 bytes of metadata from https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml2015-10-19 23:24:15,494 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:290] - Processing new metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,495 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:379] - Unmarshalling metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,678 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:423] - Preprocessing metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,679 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:276] - Applying metadata filter2015-10-19 23:24:15,680 - DEBUG [org.opensaml.saml.metadata.resolver.filter.impl.MetadataFilterChain:77] - Applying filter org.opensaml.saml.metadata.resolver.filter.impl.EntityRoleFilter2015-10-19 23:24:15,682 - DEBUG [org.opensaml.saml.metadata.resolver.filter.impl.MetadataFilterChain:77] - Applying filter org.opensaml.saml.metadata.resolver.filter.impl.NodeProcessingMetadataFilter2015-10-19 23:24:15,683 - ERROR [net.shibboleth.idp.saml.metadata.impl.AttributeMappingNodeProcessor:144] - Requested Attributes Mapper: Invalid Attribute resolver configuration.2015-10-19 23:24:15,684 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:433] - Releasing cached DOM for metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,700 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:437] - Post-processing metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,702 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:441] - Computing expiration time for metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,752 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:446] - Expiration of metadata from 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml' will occur at 2015-10-20T07:24:14.785Z2015-10-19 23:24:15,753 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:465] - New metadata successfully loaded for 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml'2015-10-19 23:24:15,792 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:306] - Next refresh cycle for metadata provider 'https://login.microsoftonline.com/common/FederationMetadata/2007-06/FederationMetadata.xml' will occur on '2015-10-20T06:24:15.027Z' ('2015-10-20T02:24:15.027-04:00' local time)2015-10-19 23:24:15,796 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:378] - Service 'shibboleth
but later (when I try to authenticate my user):

2015-10-19 23:26:49,977 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'2015-10-19 23:26:49,990 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:334] - Metadata backing store does not contain any EntityDescriptors with the ID: urn:federation:MicrosoftOnline2015-10-19 23:26:49,991 - DEBUG [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:198] - Metadata document did not contain a descriptor for entity urn:federation:MicrosoftOnline2015-10-19 23:26:49,991 - DEBUG [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:281] - Metadata document did not contain any role descriptors of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor for entity urn:federation:MicrosoftOnline2015-10-19 23:26:49,991 - DEBUG [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:252] - Metadata document does not contain a role of type {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor supporting protocol urn:oasis:names:tc:SAML:2.0:protocol for entity urn:federation:MicrosoftOnline2015-10-19 23:26:49,992 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:108] - Message Handler:  No metadata returned for urn:federation:MicrosoftOnline in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol2015-10-19 23:26:49,997 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:154] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context2015-10-19 23:26:49,997 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:175] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'2015-10-19 23:26:49,997 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler:109] - Message Handler:  No metadata context found, nothing to do2015-10-19 23:26:50,014 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer urn:federation:MicrosoftOnline2015-10-19 23:26:50,019 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:284] - Resolving relying party configuration2015-10-19 23:26:50,019 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:290] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty2015-10-19 23:26:50,020 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request

I must be missing some configuration somewhere?



 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151020/89c60d34/attachment.html>

More information about the users mailing list