Attributes not being release from AD

Fri Feb 12 13:45:15 EST 2016

Thanks Daniel,
    I did some testing and was able to bind and retrieve attributes using my service account.  To further test (since our shib install is still in testing) I set my user account as the bind account for the attribute resolver data connector.  I noticed it was using mrichter at coastal.edu<mailto:mrichter at coastal.edu> where the auth was using CN=mrichter, DC=coastal, DC=edu.    I changed it to match and restarted the shib service.  Still no luck.  Now the request lines are almost (but not exactly) the same.  I noticed the attribute resolver timeout is set to -1 while auth is 3000.  I assumed -1 was indefinite, but not sure now.  Not sure where this is set.  Below are the two lines form the log.  The first is the Auth bind which returns attributes.  The second is the resolver request which does not. Both use the same account to bind.  Any ideas,  I’m kind of spinning my wheels right now.  Thanks again for the assistance.

Auth:
2016-02-12 13:24:14,758 - DEBUG [org.ldaptive.BindOperation:138] - execute request=[org.ldaptive.BindRequest at 2027945964::bindDn=CN=mrichter,DC=coastal, DC=edu, saslConfig=null, controls=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 2093912051::config=[org.ldaptive.ConnectionConfig at 1438748210::ldapUrl=ldap://s12dc3.coastal.edu:389, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 1009462361::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 2c7b6eed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=true, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory at 1847560384::metadata=[ldapUrl=ldap://s12dc3.coastal.edu:389, count=1], environment={com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1493260940::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at 1b0dd58c, controlProcessor=org.ldaptive.provider.ControlProcessor at 29074836, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory at 782295653::factory=sun.security.ssl.SSLSocketFactoryImpl at 3ceb36f9, sslConfig=[org.ldaptive.ssl.SslConfig at 1009462361::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 2c7b6eed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null], providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection at 6fedded2<mailto:providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection at 6fedded2>]

Attrib resolve

2016-02-12 13:24:15,039 - DEBUG [org.ldaptive.BindOperation:138] - execute request=[org.ldaptive.BindRequest at 1352120443::bindDn=CN=mrichter,DC=coastal,DC=edu, saslConfig=null, controls=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 1849386952::config=[org.ldaptive.ConnectionConfig at 1638631856::ldapUrl=ldap://s12dc3.coastal.edu:389, connectTimeout=-1, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 1417203230::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 5edc70ed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=true, connectionInitializer=[org.ldaptive.BindConnectionInitializer at 1125614861::bindDn=CN=mrichter,DC=coastal,DC=edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiStartTLSConnectionFactory at 414315122::metadata=[ldapUrl=ldap://s12dc3.coastal.edu:389, count=1], environment={java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 505635448::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$ActivePassiveConnectionStrategy at 44fff386, controlProcessor=org.ldaptive.provider.ControlProcessor at 1fc713c9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null], sslSocketFactory=[org.ldaptive.ssl.TLSSocketFactory at 1882290876::factory=sun.security.ssl.SSLSocketFactoryImpl at 1d8840a1, sslConfig=[org.ldaptive.ssl.SslConfig at 1417203230::credentialConfig=org.ldaptive.ssl.CredentialConfigFactory$2 at 5edc70ed, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null]], hostnameVerifier=null], providerConnection=org.ldaptive.provider.jndi.JndiStartTLSConnection at 28b871ff]

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Friday, February 12, 2016 12:22 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Attributes not being release from AD

On Fri, Feb 12, 2016 at 11:01 AM, Michael Richter <mrichter at coastal.edu<mailto:mrichter at coastal.edu>> wrote:

Druing Attribute resolution this is the result I get.  As you see, no attributes are returned even though I’m using the same search query .
The attributes you're getting with the authentication flow are read as the authenticated user, not the bindDn credential used to resolve the DN. (Although you can change that behavior.)

10:32:20,017 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response at 1430069391::result=[org.ldaptive.SearchResult at -882078420::entries=[[dn=CN=mrichter,DC=coastal, DC=edu[],
You found the entry, but got no attributes.

baseDn=DC=coastal, DC=edu, searchFilter=[org.ldaptive.SearchFilter at -523314116::filter=(sAMAccountName=mrichter), parameters={}], returnAttributes=[cn,sn,displayName,mail,sAMAccountName], searchScope=SUBTREE,

You definitely requested some attributes.

bindDn=shibdir at coastal.edu<mailto:shibdir at coastal.edu>, bindSaslConfig=null, bindControls=null]],

Is this user authorized to read the requested attributes?
It's generally easier to test this stuff using a command line tool like ldapsearch rather than exercising the IDP.

ldapsearch -H ldap://s12dc3.coastal.edu:389<http://s12dc3.coastal.edu:389> -Z -x \\
-b 'DC=coastal,DC=edu' \\
-D 'shibdir at coastal.edu<mailto:shibdir at coastal.edu>' -W \\
'(sAMAccountName=mrichter)'

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160212/88d9f2d9/attachment-0001.html>