Attributes not being release from AD

Fri Feb 12 11:01:58 EST 2016

Thanks again for all the help!!  I'm almost there.  I changed uid to sAMAccountName and got some positive results.  During the authentication process I'm able to pull attributes using the search filter (sAMAccountName=mrichter) This is the response I get.

2016-02-12 10:32:19,782 - DEBUG [org.ldaptive.auth.SearchEntryResolver:418] - resolved result=[org.ldaptive.SearchResult at 1957674479::entries=[[dn=CN=mrichter,DC=coastal, DC=edu[[mail[mrichter at coastal.edu]], [displayName[Michael Richter]], [sn[Richter]], [cn[mrichter]], [sAMAccountName[mrichter]]], responseControls=null, messageId=-1]], references=[]] for criteria=[org.ldaptive.auth.AuthenticationCriteria at 1236430277::dn=CN=mrichter,DC=coastal, DC=edu, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 810872251::user=mrichter, retAttrs=[cn, sn, displayName, mail, sAMAccountName]]]

Druing Attribute resolution this is the result I get.  As you see, no attributes are returned even though I'm using the same search query .  All the connection info should be the same.  Not sure why I'm getting Server down errors as well.   Below the response, I've included my DataConnector below.  Thanks

10:32:20,017 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response at 1430069391::result=[org.ldaptive.SearchResult at -882078420::entries=[[dn=CN=mrichter,DC=coastal, DC=edu[], responseControls=null, messageId=-1]], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=[ldap://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu, ldap://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu, ldap://coastal.edu/CN=Configuration,DC=coastal,DC=edu], messageId=-1] for request=[org.ldaptive.SearchRequest at -1505036113::baseDn=DC=coastal, DC=edu, searchFilter=[org.ldaptive.SearchFilter at -523314116::filter=(sAMAccountName=mrichter), parameters={}], returnAttributes=[cn,sn,displayName,mail,sAMAccountName], searchScope=SUBTREE, timeLimit=3000, sizeLimit=1, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=[], searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1893214953::config=[org.ldaptive.ConnectionConfig at 1638631856::ldapUrl=ldap://s12dc3.coastal.edu:389, connectTimeout=-1, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 1417203230::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 5edc70ed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=true, connectionInitializer=[org.ldaptive.BindConnectionInitializer at 1125614861::bindDn=shibdir at coastal.edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory at 322222445::metadata=[ldapUrl=ldap://s12dc3.coastal.edu:389, count=1], environment={java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 505635448::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy at 44fff386, controlProcessor=org.ldaptive.provider.ControlProcessor at 1fc713c9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory at 641214615::factory=sun.security.ssl.SSLSocketFactoryImpl at 7fd6a37b, sslConfig=[org.ldaptive.ssl.SslConfig at 1417203230::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 5edc70ed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null], providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection at 4e68410a]

2016-02-12 10:32:20,017 - INFO [net.shibboleth.idp.attribute.resolver.AbstractResolverPlugin:191] - Resolver plugin 'coastal' produced no value.

Data Connector

<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"

        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"

        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"

        principal="%{idp.attribute.resolver.LDAP.bindDN}"

        principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"

        useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"

                                >

        <dc:FilterTemplate>

            <![CDATA[

                %{idp.attribute.resolver.LDAP.searchFilter}

            ]]>

        </dc:FilterTemplate>

        <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">

            <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>

        </dc:StartTLSTrustCredential>

    </resolver:DataConnector>

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Douglas E Engert
Sent: Friday, February 12, 2016 9:11 AM
To: users at shibboleth.net
Subject: Re: Attributes not being release from AD

The uid attribute can be defined in AD, but requires your windows admins to populate it. It may not be set in your domain.

I don't have access to AD since I retired when we were using IDP 2, but you may want to look at AD using some windows tools such as these:

  https://technet.microsoft.com/en-us/sysinternals/adexplorer.aspx

  https://support.microsoft.com/en-us/kb/224543

Using ldapsearch from unix might also give you some insight into what attributes are in your AD and what your AD admins have done to keep the data clean. Its also a good way to understand LDAP searching and filters.

For example write some filters to look around for user entries that don't have attributes set as you might expect.

You AD admins may have users located locations other then  CN=users,DC=coastal,DC=edu.

If you have a forest users may be in the forest domains. You did get some referrals, these may be for the sub domains.

with IDP 2 the basic filter we used was:

(&(objectClass=user)(sAMAccountName=$instancePrincipalName.get(0))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

AD has some special filters to look at the bits is userAccountControl, 2 was the account is locked.

  https://support.microsoft.com/en-us/kb/269181

If all the attributes you need are in the Global catalog which is a collections of some attributes from the forest, you can search the GC.

Work with you AD adminms so you use attributes they maintain.

On 2/11/2016 10:11 PM, Daniel Fisher wrote:

> On Thu, Feb 11, 2016 at 5:03 PM, Michael Richter <mrichter at coastal.edu <mailto:mrichter at coastal.edu<mailto:mrichter at coastal.edu%20%3cmailto:mrichter at coastal.edu>>> wrote:

>

>     2016-02-11 16:58:52,577 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response at 364560346::result=[org.ldaptive.SearchResult at 4303153::entries=[], references=[]],

>     resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=[ldap://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu

>     <http://DomainDnsZones.coastal.edu/DC=DomainDnsZones,DC=coastal,DC=edu>, ldap://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu

>

> <http://ForestDnsZones.coastal.edu/DC=ForestDnsZones,DC=coastal,DC=edu

> >, ldap://coastal.edu/CN=Configuration,DC=coastal,DC=edu

> <http://coastal.edu/CN=Configuration,DC=coastal,DC=edu>],

> messageId=-1]

>

>

> Your search produced no entries, but you did get some referrals.

>

>     for

> request=[org.ldaptive.SearchRequest at 1651751780::baseDn=DC=coastal,

> DC=edu,

> searchFilter=[org.ldaptive.SearchFilter at 311971475::filter=(uid=mrichte

> r),

>

>

> Confirm that baseDn and search filter are correct. Doesn't active directory store users under a branch like CN=users,DC=coastal,DC=edu?

>

> --Daniel Fisher

>

>

>

--

  Douglas E. Engert  <DEEngert at gmail.com<mailto:DEEngert at gmail.com>>

--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160212/aa27602e/attachment.html>