IdP 3.2.1 Ldap problem

[Negib A. Sherif]

Thanks Tom. 

Indeed I was missing idp.attribute.resolver.LDAP.returnAttributes. Now, I do see  IdP login page and get the following error when trying to login. 
the error is about baseDN. Ldap is in remote site and don't have access to it. baseDN never worked even in my 2.x IdP.  In my IdP 2.x, I have local OpenLdap
and remote Ldap. baseDN for my local OpenLdap works fine. I don't want to disable baseDN because I needed for my local OpenLdap. Can some one help? 
Can wild card * be assigned for the value of baseDN in IdP 3.2.1?
 
016-02-03 12:41:50,734 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:244] - resolve user=aa8288
2016-02-03 12:41:50,735 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:310] - searching for DN using userFilter
2016-02-03 12:41:50,735 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest at -2092661943::baseDn=undefined,  

2016-02-03 12:41:50,742 - WARN [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:175] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by aa8288 produced exception
org.ldaptive.LdapException: javax.naming.InvalidNameException: undefined: [LDAP: error code 34 - Invalid DN]; remaining name 'undefined'
        at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)
Caused by: javax.naming.InvalidNameException: undefined: [LDAP: error code 34 - Invalid DN]
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3074)
 

________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Tom Zeller <tzeller at dragonacea.biz>
Sent: Wednesday, February 3, 2016 10:26 AM
To: Shib Users
Subject: Re: IdP 3.2.1 Ldap problem

> On Feb 3, 2016, at 9:14 AM, Negib A. Sherif <aa8288 at wayne.edu> wrote:
>
> I am working on IdP 3.2.1 and stuck with Ldap problem. No error is showing on idp-process.log when tomcat8 starts. However,
> I am getting the following error after SP directed me to IdP and before opening login screen on IdP.
>  I have 2.x running fine and want to setup, clean, 3.2.1 in another server. Help is appreciated.
>
> 2016-02-03 09:55:45,072 - ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:231] - Service 'shibboleth.AttributeResolverService': Reload for shibboleth.AttributeResolverService failed
> net.shibboleth.utilities.java.support.service.ServiceException: org.springframework.beans.factory.BeanDefinitionStoreException: Invalid bean definition with name 'myLDAP' defined in null: Could not resolve placeholder 'idp.attribute.resolver.LDAP.returnAttributes' in string value "%{idp.attribute.resolver.LDAP.returnAttributes}"; nested exception is java.lang.IllegalArgumentException: Could not resolve placeholder 'idp.attribute.resolver.LDAP.returnAttributes' in string value "%{idp.attribute.resolver.LDAP.returnAttributes}"
>         at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
> Caused by: org.springframework.beans.factory.BeanDefinitionStoreException: Invalid bean definition with name 'myLDAP' defined in null: Could not resolve placeholder 'idp.attribute.resolver.LDAP.returnAttributes' in string value "%{idp.attribute.resolver.LDAP.returnAttributes}"; nested exception is java.lang.IllegalArgumentException: Could not resolve placeholder 'idp.attribute.resolver.LDAP.returnAttributes' in string value "%{idp.attribute.resolver.LDAP.returnAttributes}"
>         at org.springframework.beans.factory.config.PlaceholderConfigurerSupport.doProcessProperties(PlaceholderConfigurerSupport.java:211)
> Caused by: java.lang.IllegalArgumentException: Could not resolve placeholder 'idp.attribute.resolver.LDAP.returnAttributes' in string value "%{idp.attribute.resolver.LDAP.returnAttributes}"
>         at org.springframework.util.PropertyPlaceholderHelper.parseStringValue(PropertyPlaceholderHelper.java:174)
>
> Here is what i have in ldap.properties and attribute-resolver xml files.
>
> ldap.properties file:
>
> idp.authn.LDAP.authenticator        = bindSearchAuthenticator
> idp.attribute.resolver.LDAP.ldapURL = ldap://x.y.z:389
> idp.attribute.resolver.LDAP.bindDN  = bindDN info here
> idp.authn.LDAP.useStartTLS          = false
> idp.authn.LDAP.useSSL               = false
> idp.authn.LDAP.sslConfig            = jvmTrust
> idp.attribute.resolver.LDAP.bindDNCredential  = password
> idp.attribute.resolver.LDAP.searchFilter = (uid=$requestContext.principalName)
>
>
> attribute-resolver.xml file:
>
>     <resolver:AttributeDefinition id="uid" xsi:type="ad:Simple" sourceAttributeID="uid">
>         <resolver:Dependency ref="myLDAP" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="urn:mace:dir:attribute-def:uid" encodeType="false" />
>         <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:0.9.2342.19200300.100.1.1" friendlyName="uid" encodeType="false" />
>     </resolver:AttributeDefinition>
>
> <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>         ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
>         principal="%{idp.attribute.resolver.LDAP.bindDN}"
>         principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}">
>         <dc:FilterTemplate>
>             <![CDATA[
>                 %{idp.attribute.resolver.LDAP.searchFilter}
>             ]]>
>         </dc:FilterTemplate>
>         <dc:ReturnAttributes>%{idp.attribute.resolver.LDAP.returnAttributes}</dc:ReturnAttributes>
>     </resolver:DataConnector>
>

Looks like you’re missing idp.attribute.resolver.LDAP.returnAttributes in ldap.properties.

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net