v3 AD setup

[Brian Biggs]

For one thing, your idp.authn.LDAP.bindDN is definitely wrong.
Should be more like "cn=bind_account_name,ou=test,dc=domain,dc=com"

-Brian

On 10/30/2015 12:57 PM, Ower All wrote:
> Thank you peter. We have decided to try JAAS since we could not get it 
> working this way. Has anyone seen this error before?
>
> 2015-10-30 15:40:58,646 - ERROR 
> [org.opensaml.profile.action.impl.DecodeMessage:73] - Profile Action 
> DecodeMessage: Unable to decode incoming request
> org.opensaml.messaging.decoder.MessageDecodingException: No 
> SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP 
> Redirect message
>         at 
> org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:73)
> 2015-10-30 15:48:24,012 - INFO 
> [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:199] - 
> Profile Action ValidateUsernamePasswordAgainstJAAS: Login by testuser 
> failed
> javax.security.auth.login.LoginException: Authentication failed: 
> [org.ldaptive.auth.AuthenticationResponse at 1542122009::authenticationResultCode=DN_RESOLUTION_FAILURE, 
> ldapEntry=null, accountState=null, result=false, resultCode=null, 
> message=DN cannot be null, controls=null]
>         at 
> org.ldaptive.jaas.LdapLoginModule.login(LdapLoginModule.java:160)
>
> We edited JAAS.config with our information. Thank you
>
>
>
>
> On Thursday, October 29, 2015 3:15 PM, Peter Schober 
> <peter.schober at univie.ac.at> wrote:
>
>
> First of all, you're missing an error description.
>
> * Ower All <owerall at yahoo.com <mailto:owerall at yahoo.com>> [2015-10-29 
> 19:24]:
> > idp.authn.LDAP.ldapURL                           = 
> ldaps://test.domain.com (do I need a port # here?)
> > #idp.authn.LDAP.useStartTLS                   = true
> > #idp.authn.LDAP.useSSL                          = false
> > #idp.authn.LDAP.connectTimeout             = 3000
> > #idp.authn.LDAP.sslConfig                       = jvmTrust
> > idp.authn.LDAP.baseDN = ou=test,dc=domain,dc=com
> > #idp.authn.LDAP.subtreeSearch                = false
> > idp.authn.LDAP.bindDN                              = 
> testacct at test.domain.com <mailto:testacct at test.domain.com>
> > idp.authn.LDAP.bindDNCredential                 = *****
>
>
> As per
> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration
> the parameter idp.authn.LDAP.useStartTLS defaults to true (which will
> be active if you leave it commented out), which won't work when you're
> connecting with an ldapURL of ldaps.
> So next I'd uncomment idp.authn.LDAP.useStartTLS and set it to false.
>
> Then your ldapURL is ldaps (implying useSSL, to me) but the default of
> idp.authn.LDAP.useSSL=false is active. No idea what the libraries will
> do in such a case, but it doesn't make much sense.
>
> To what port you should connect is up to your deployment, we can't
> tell you. The libraries will pick the IANA-defined standard port from
> the ldapURL, I'd expect. So once the scheme in the ldapURL is correct
> you'd only have to add a port if you're not connecting to the
> IANA-defined standard ports, but e.g. to MS-AD's "global catalog"
> (AFAIK). In short: ask your MS-AD admins.
>
> There's also a section on MS-AD in the documentation.
> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration
>
> -peter
> -- 
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
>
>
>

-- 

Brian Biggs
Sonoma State University

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151030/9985f36c/attachment-0001.html>