v3 AD setup

[Peter Schober]

First of all, you're missing an error description.

* Ower All <owerall at yahoo.com> [2015-10-29 19:24]:
> idp.authn.LDAP.ldapURL                           = ldaps://test.domain.com (do I need a port # here?)
> #idp.authn.LDAP.useStartTLS                   = true
> #idp.authn.LDAP.useSSL                          = false
> #idp.authn.LDAP.connectTimeout             = 3000
> #idp.authn.LDAP.sslConfig                       = jvmTrust
> idp.authn.LDAP.baseDN                            = ou=test,dc=domain,dc=com
> #idp.authn.LDAP.subtreeSearch                = false
> idp.authn.LDAP.bindDN                              = testacct at test.domain.com
> idp.authn.LDAP.bindDNCredential                 = ***** 

As per
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration
the parameter idp.authn.LDAP.useStartTLS defaults to true (which will
be active if you leave it commented out), which won't work when you're
connecting with an ldapURL of ldaps.
So next I'd uncomment idp.authn.LDAP.useStartTLS and set it to false.

Then your ldapURL is ldaps (implying useSSL, to me) but the default of
idp.authn.LDAP.useSSL=false is active. No idea what the libraries will
do in such a case, but it doesn't make much sense.

To what port you should connect is up to your deployment, we can't
tell you. The libraries will pick the IANA-defined standard port from
the ldapURL, I'd expect. So once the scheme in the ldapURL is correct
you'd only have to add a port if you're not connecting to the
IANA-defined standard ports, but e.g. to MS-AD's "global catalog"
(AFAIK). In short: ask your MS-AD admins.

There's also a section on MS-AD in the documentation.
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration

-peter