IdP 3.2.1 Ldap problem

[Negib A. Sherif]

Hi Daniel,


In my IdP 2.x I have the following Remote and Local configurations. Depending the user uid either remote or local ldap authentication is established. Off course one of them will return an error message in idp-process.log file because uid does not

exit; which is fine. uid is not duplicated and the two ldaps are unique. not a fail back. This is what I have on 2.x and it works perfectly. Right now, I am just trying to make it to work IdP 3.2.1 with the remote Ldap and come back to add local ldap.


attribute-resolver.xml file:


 <!-- Local Open Source LDAP Connector -->

    <resolver:DataConnector id="myLocalLDAP" xsi:type="dc:LDAPDirectory"
        xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldap://x.y.wayne.edu:389"
        baseDN="dc=x,dc=y,dc=wayne,dc=edu"
        principal="cn=admin,dc=x,dc=y,dc=wayne,dc=edu"
        principalCredential="password"
        connectionStrategy="ACTIVE_PASSIVE"
        lowercaseAttributeNames="true">
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>uid</dc:ReturnAttributes>
        <ConnectionPool minPoolSize="3"/>
    </resolver:DataConnector>


    <!-- Remote LDAP Connector -->

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldaps://A.wayne.edu:636"
        principal="cn=remote-cn-name,ou=system groups,ou=groups,dc=wayne,dc=edu"
        principalCredential="password"
        lowercaseAttributeNames="true">
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
        <dc:ReturnAttributes>uid</dc:ReturnAttributes>
        <ConnectionPool minPoolSize="3"/>
    </resolver:DataConnector>

 In login.config file:

<!-- Local -->
  edu.vt.middleware.ldap.jaas.LdapLoginModule Sufficient
      ldapUrl="ldap://x.y.wayne.edu:389"
      baseDn="cn=Employee,ou=OrganizationalStatus,dc=x,dc=y,dc=wayne,dc=edu"
      bindDn="cn=local-group-admin,dc=x,dc=y,dc=wayne,dc=edu"
      bindCredential="password"
      ssl="false"
      userFilter="uid={0}";

<!-- Remote -->
edu.vt.middleware.ldap.jaas.LdapLoginModule Sufficient
      ldapUrl="ldaps://A.wayne.edu:636"
      bindDn="cn=remote-group-admin,ou=system groups,ou=groups,dc=wayne,dc=edu"
      bindCredential="password"
      ssl="true"
      userFilter="uid={0}";

The return baseDN for local Ldap is dn = cn=Employee,ou=OrganizationalStatus,dc=x,dc=y,dc=wayne,dc=edu. Since I couldn't make it to work remote ldap with baseDN, I am fine with that. Nothing for remote Ldap since no baseDN was configured.




________________________________
From: users <users-bounces at shibboleth.net> on behalf of Daniel Fisher <dfisher at vt.edu>
Sent: Wednesday, February 3, 2016 2:12 PM
To: Shib Users
Subject: Re: IdP 3.2.1 Ldap problem

On Wed, Feb 3, 2016 at 12:44 PM, Negib A. Sherif <aa8288 at wayne.edu<mailto:aa8288 at wayne.edu>> wrote:
Indeed I was missing idp.attribute.resolver.LDAP.returnAttributes. Now, I do see  IdP login page and get the following error when trying to login.
the error is about baseDN. Ldap is in remote site and don't have access to it. baseDN never worked even in my 2.x IdP.  In my IdP 2.x, I have local OpenLdap
and remote Ldap. baseDN for my local OpenLdap works fine. I don't want to disable baseDN because I needed for my local OpenLdap. Can some one help?
Can wild card * be assigned for the value of baseDN in IdP 3.2.1?

Can you elaborate on how you expect DN resolution to occur on the remote LDAP? Typically, if you're not searching on a branch it's because you can derive the DN entirely from the username. Is that the use case you have?

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160203/d254cf19/attachment-0001.html>