v3 AD setup

[Daniel Fisher]

On Thu, Oct 29, 2015 at 2:20 PM, Ower All <owerall at yahoo.com> wrote:

> Hello. We have successfully upgraded our IDP to v3. The problem we have is
> that we are unable to set it up with our active directory.  We have edited
> the file ldap.properties with the following config changes. Is there
> anything that I can look at or check? Thanks
>
> idp.authn.LDAP.authenticator                    = adAuthenticator
>
>
This authenticator configuration leverages the ability of active directory
to authenticate a user using the form 'useracct at test.domain.com'. It
requires that you configure the idp.authn.LDAP.dnFormat property. So in
your case, something like '%s at test.domain.com'


> idp.authn.LDAP.ldapURL                           = ldaps://test.domain.com (do
> I need a port # here?)
>

You need a port if you're not using the default of 636.


> idp.authn.LDAP.baseDN                            = ou=test,dc=domain,dc=com
> #idp.authn.LDAP.subtreeSearch                = false
>
idp.authn.LDAP.bindDN                              =
> testacct at test.domain.com
> idp.authn.LDAP.bindDNCredential                 = *****
>
>

These properties are not used by the adAuthenticator, they are used by the
bindSearchAuthenticator.

Many deployers do choose the bindSearchAuthenticator for use with Active
Directory. I'm not certain of all the tradeoffs at this point. I can say
that the adAuthenticator will be more performant because it doesn't have to
perform a DN resolution. It is also wired up by default for password
expiration. However if you need to grab attributes during authentication
that require a manager credential, you're better off using the
bindSearchAuthenticator.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151029/3f4fc681/attachment.html>