IdPv3 LDAP password issue

[Alex Stuart]

On 26/02/2016 12:25, John Horne wrote:
> Hello,
> 
> In our IdP configuration we have an LDAP data connector which uses a
> userid and password to bind to the LDAP server. If I specify the LDAP
> password directly in the attribute-resolver.xml file, then this works:
> 
>   principalCredential="abc123"
> 
> However, looking at the example 'attribute-resolver-ldap.xml' file, if
> I change our attribute-resolver.xml file and modify the ldap.properties
> file accordingly, then we get an error when using:
> 
>   principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
> 
> The error indicates it is the credentials that is failing:
> 
> =====
> 2016-02-26 12:17:09,420 - ERROR
> [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector:1
> 43] - Data Connector 'myLDAP': Invalid connector configuration
> net.shibboleth.idp.attribute.resolver.dc.ValidationException: [org.ldap
> tive.LdapException at 1744389827::resultCode=INVALID_CREDENTIALS,
> matchedDn=null, responseControls=null, referralURLs=null, messageId=-1, 
> message=javax.naming.AuthenticationException: [LDAP: error code 49 -
> 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error,
> data 52e, v1db1],
> providerException=javax.naming.AuthenticationException: [LDAP: error
> code 49 - 80090308: LdapErr: DSID-0C0903A9, comment:
> AcceptSecurityContext error, data 52e, v1db1]]
> =====

Are you only getting errors from the attribute resolver?

In ldap.properties, the idp.attribute.resolver.LDAP.bindDNCredential
property is set from idp.authn.LDAP.bindDNCredential by default. So are
you authenticating using LDAP & getting an error there too?

Alex



-- 
Alex Stuart
Team Leader - Federated Access Management
EDINA, University of Edinburgh

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.