Active Directory ldaps authentication

[Mr. Christopher Bland]

Hi Daniel,

You are correct. We are following referrals.  I am reviewing the LdapServerIssues link you provided.  For our AD setup we may need to setup a Global Catalog to solve my issues.

Will keep you posted.

-Chris


On Sep 2, 2015, at 10:26 AM, Daniel Fisher <dfisher at vt.edu<mailto:dfisher at vt.edu>> wrote:

On Tue, Sep 1, 2015 at 9:45 PM, Mr. Christopher Bland <chris at fdu.edu<mailto:chris at fdu.edu>> wrote:
]2015-09-01 20:51:46.457 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:127] - Verify with the following parameters:
2015-09-01 20:51:46.457 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:128] -   hostname = ADServer1.addomain.fdu.edu<http://adserver1.addomain.fdu.edu/>
2015-09-01 20:51:46.457 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:129] -   cert = CN=ADServer2.addomain.fdu.edu<http://adserver2.addomain.fdu.edu/>
2015-09-01 20:51:46.458 - DEBUG [edu.vt.middleware.ldap.ssl.DefaultHostnameVerifier:202] - verifyDNS using subjectAltNames = [ADDOMAIN, addomain.fdu.edu<http://addomain.fdu.edu/>, ADServer6.addomain.fdu.edu<http://adserver6.addomain.fdu.edu/>]
2015-09-01 20:51:46.681 - DEBUG [edu.vt.middleware.ldap.jaas.LdapLoginModule:164] - Error occured attempting authentication
javax.naming.PartialResultException: null

Can you post your JAAS config? It looks like you're following referrals on DN resolution, but you'd have to explicitly configure that.

Also, see this page: https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues

--Daniel Fisher

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150902/83b09aba/attachment.html>