Attributes not being release from AD

[Daniel Fisher]

On Fri, Feb 12, 2016 at 11:01 AM, Michael Richter <mrichter at coastal.edu>
wrote:

> Druing Attribute resolution this is the result I get.  As you see, no
> attributes are returned even though I’m using the same search query .
>
The attributes you're getting with the authentication flow are read as the
authenticated user, not the bindDn credential used to resolve the DN.
(Although you can change that behavior.)



> 10:32:20,017 - DEBUG [org.ldaptive.SearchOperation:168] - execute
> response=[org.ldaptive.Response at 1430069391
> ::result=[org.ldaptive.SearchResult at -882078420::entries=[[dn=CN=mrichter,DC=coastal,
> DC=edu[],
>
You found the entry, but got no attributes.



> baseDn=DC=coastal, DC=edu, searchFilter=[org.ldaptive.SearchFilter@
> -523314116::filter=(sAMAccountName=mrichter), parameters={}],
> returnAttributes=[cn,sn,displayName,mail,sAMAccountName],
> searchScope=SUBTREE,
>

You definitely requested some attributes.


> bindDn=shibdir at coastal.edu, bindSaslConfig=null, bindControls=null]],
>

Is this user authorized to read the requested attributes?
It's generally easier to test this stuff using a command line tool like
ldapsearch rather than exercising the IDP.

ldapsearch -H ldap://s12dc3.coastal.edu:389 -Z -x \\
-b 'DC=coastal,DC=edu' \\
-D 'shibdir at coastal.edu' -W \\
'(sAMAccountName=mrichter)'

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160212/82569482/attachment.html>