adAuthenticator BAD_NAME but Login Success

[Daniel Fisher]

On Fri, Jul 29, 2016 at 4:19 PM, Klingenstein, Nate <
nklingenstein at calstate.edu> wrote:

> 2016-07-29 11:23:52,909 - DEBUG
> [org.ldaptive.auth.PooledBindAuthenticationHandler:67] - authenticate
> criteria=[org.ldaptive.auth.AuthenticationCriteria at 1387818266::dn=
> helloworld at campus.csu.edu,
> authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 1303344754::user=helloworld,
> retAttrs=[passwordExpirationTime, loginGraceRemaining]]]
>

You're requesting return attributes.
By default that authenticator doesn't have an entryResolver, so a
SearchEntryResolver is used, which is causing the non-fatal error.
In your case just comment out 'idp.authn.LDAP.returnAttributes' and no
entry resolution will occur.

The adAuthenticator configuration is just a formatDnResolver and
ActiveDirectoryAuthenticationResponseHandler.
Further experience with this configuration is causing me to question
whether it was the right approach.
While Active Directory does allow LDAP binds with the UPN, it doesn't
appear to be supported on all versions.
It's possible we'll recommend using the the bindSearchAuthenticator for AD
instances going forward and there's certainly nothing wrong with using that
approach now.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160801/ef6605cb/attachment.html>