Shib v3 IDP with multiple OU's

[Dave Perry]

(should have noted, that goes in ldap.properties)

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Dave Perry
Sent: 16 August 2016 09:48
To: Shib Users
Subject: RE: Shib v3 IDP with multiple OU's

Just use something like this:
idp.authn.LDAP.baseDN                           = ou=accounts,dc=domain,dc=local (so dc=umb,dc=edu for you)
idp.authn.LDAP.subtreeSearch                   = true
idp.authn.LDAP.userFilter                       = (samaccountname={user})

Under Accounts, we have Staff and Students also. Then sites, then departments… etc. And the above works fine.


HTH,
Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk<mailto:elearning at hull-college.ac.uk> *

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel McDonald
Sent: 15 August 2016 22:53
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Shib v3 IDP with multiple OU's

Hi,

Im trying to configure shibboleth IDP 3.2.1 and having some probs authenticating against our AD....

We have multiple ou's with no account overlap:
ou=Staff
ou=Students
ou=Faculty

The doc for LDAPAuthnConfiguration<https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration> says that you can have idp.authn.LDAP.userFilter=
(&(|(ou:dn:=people)(ou:dn:=guests))(uid={user})) and have it search multiple OU's.

This works for me with just 1 ou in ldap.properties:
idp.authn.LDAP.baseDN                         = ou=Staff,DC=umb,DC=edu
idp.authn.LDAP.userFilter                      = (mail={user})

But when I try to use what the docs suggest to use 2 OU's it doesnt work:
idp.authn.LDAP.baseDN                         = DC=umb,DC=edu
idp.authn.LDAP.userFilter                       = (&(|(ou:dn:=Staff)(ou:dn=Students))(mail={user}))

I noticed it says "Active Directory does not fully support extensible match rules" and im im assuming thats why it doesnt work.

Does someone have a config that they use to connect to 2 or more OU's in AD that they could share????

Thanks!!
Dan
The Review Newsletter<http://www.hull-college.ac.uk/about-us/stakeholders-newsletter>

This message is sent in confidence for the addressee  only.  It may contain confidential or sensitive  information.  The contents are not to be disclosed  to anyone other than the addressee.  Unauthorised  recipients are requested to preserve this  confidentiality and to advise us of any errors in  transmission.  Any views expressed in this message  are solely the views of the individual and do not  represent the views of the College.  Nothing in this  message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160816/496c75e9/attachment.html>