adAuthenticator BAD_NAME but Login Success

[Klingenstein, Nate]

Daniel,

> [org.ldaptive.auth.AuthenticationRequest at 1303344754::user=helloworld, retAttrs=[passwordExpirationTime, loginGraceRemaining]]]
> 
> You're requesting return attributes.

Indeed, idp.authn.LDAP.returnAttributes = passwordExpirationTime,loginGraceRemaining

> By default that authenticator doesn't have an entryResolver, so a SearchEntryResolver is used, which is causing the non-fatal error.

I understand what you mean, but it's going to take me a little research to really get my head wrapped around it.

> In your case just comment out 'idp.authn.LDAP.returnAttributes' and no entry resolution will occur.

That makes perfect sense, thanks.  It's the specific meaning of an entryResolver and its presence or absence that I need to get.

> It's possible we'll recommend using the the bindSearchAuthenticator for AD instances going forward and there's certainly nothing wrong with using that approach now.

Apart from the implicit need for AD administrators to understand DN's -- may not seem like a high bar, but -- that change/deprecation would get a +1 from me as well.

Thanks so much for taking the time to explain,
Nate.