Shib v3 IDP with multiple OU's

[Daniel McDonald]

Hi,

Im trying to configure shibboleth IDP 3.2.1 and having some probs 
authenticating against our AD....

We have multiple ou's with no account overlap:
ou=Staff
ou=Students
ou=Faculty

The doc for LDAPAuthnConfiguration 
<https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration> 
says that you can have idp.authn.LDAP.userFilter=
(&(|(ou:dn:=people)(ou:dn:=guests))(uid={user})) and have it search 
multiple OU's.

This works for me with just 1 ou in ldap.properties:
idp.authn.LDAP.baseDN                         = ou=Staff,DC=umb,DC=edu
idp.authn.LDAP.userFilter                      = (mail={user})

But when I try to use what the docs suggest to use 2 OU's it doesnt work:
idp.authn.LDAP.baseDN = DC=umb,DC=edu
idp.authn.LDAP.userFilter                       = 
(&(|(ou:dn:=Staff)(ou:dn=Students))(mail={user}))

I noticed it says "Active Directory does not fully support extensible 
match rules" and im im assuming thats why it doesnt work.

Does someone have a config that they use to connect to 2 or more OU's in 
AD that they could share????

Thanks!!
Dan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160815/80e093d2/attachment-0001.html>