v3 AD setup

[Ower All]

Thank you peter. We have decided to try JAAS since we could not get it working this way. Has anyone seen this error before?
2015-10-30 15:40:58,646 - ERROR [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action DecodeMessage: Unable to decode incoming request
org.opensaml.messaging.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message
        at org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:73)
2015-10-30 15:48:24,012 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by testuser failed
javax.security.auth.login.LoginException: Authentication failed: [org.ldaptive.auth.AuthenticationResponse at 1542122009::authenticationResultCode=DN_RESOLUTION_FAILURE, ldapEntry=null, accountState=null, result=false, resultCode=null, message=DN cannot be null, controls=null]
        at org.ldaptive.jaas.LdapLoginModule.login(LdapLoginModule.java:160)
We edited JAAS.config with our information. Thank you

 


     On Thursday, October 29, 2015 3:15 PM, Peter Schober <peter.schober at univie.ac.at> wrote:
   

 First of all, you're missing an error description.

* Ower All <owerall at yahoo.com> [2015-10-29 19:24]:
> idp.authn.LDAP.ldapURL                           = ldaps://test.domain.com (do I need a port # here?)
> #idp.authn.LDAP.useStartTLS                   = true
> #idp.authn.LDAP.useSSL                          = false
> #idp.authn.LDAP.connectTimeout             = 3000
> #idp.authn.LDAP.sslConfig                       = jvmTrust
> idp.authn.LDAP.baseDN                            = ou=test,dc=domain,dc=com
> #idp.authn.LDAP.subtreeSearch                = false
> idp.authn.LDAP.bindDN                              = testacct at test.domain.com
> idp.authn.LDAP.bindDNCredential                 = ***** 

As per
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration
the parameter idp.authn.LDAP.useStartTLS defaults to true (which will
be active if you leave it commented out), which won't work when you're
connecting with an ldapURL of ldaps.
So next I'd uncomment idp.authn.LDAP.useStartTLS and set it to false.

Then your ldapURL is ldaps (implying useSSL, to me) but the default of
idp.authn.LDAP.useSSL=false is active. No idea what the libraries will
do in such a case, but it doesn't make much sense.

To what port you should connect is up to your deployment, we can't
tell you. The libraries will pick the IANA-defined standard port from
the ldapURL, I'd expect. So once the scheme in the ldapURL is correct
you'd only have to add a port if you're not connecting to the
IANA-defined standard ports, but e.g. to MS-AD's "global catalog"
(AFAIK). In short: ask your MS-AD admins.

There's also a section on MS-AD in the documentation.
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration

-peter
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151030/5247b05b/attachment.html>