IdPv3 LDAP password issue

[John Horne]

On Fri, 2016-02-26 at 12:45 +0000, Alex Stuart wrote:
> 
> On 26/02/2016 12:25, John Horne wrote:
> > 
> > Hello,
> > 
> > In our IdP configuration we have an LDAP data connector which uses
> > a userid and password to bind to the LDAP server. If I specify the
> > LDAP password directly in the attribute-resolver.xml file, then
> > this works:
> > 
> >   principalCredential="abc123"
> > 
> > However, looking at the example 'attribute-resolver-ldap.xml' file,
> > if I change our attribute-resolver.xml file and modify the
> > ldap.properties file accordingly, then we get an error when using:
> > 
> >principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}
> "
> > 
> > The error indicates it is the credentials that is failing:
> > 
> > =====
> > 2016-02-26 12:17:09,420 - ERROR
> > [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnect
> > or:1
> > 43] - Data Connector 'myLDAP': Invalid connector configuration
> > net.shibboleth.idp.attribute.resolver.dc.ValidationException:
> > [org.ldap
> > tive.LdapException at 1744389827::resultCode=INVALID_CREDENTIALS,
> > matchedDn=null, responseControls=null, referralURLs=null,
> > messageId=-1, 
> > message=javax.naming.AuthenticationException: [LDAP: error code 49
> > -
> > 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext
> > error,
> > data 52e, v1db1],
> > providerException=javax.naming.AuthenticationException: [LDAP:
> > error
> > code 49 - 80090308: LdapErr: DSID-0C0903A9, comment:
> > AcceptSecurityContext error, data 52e, v1db1]]
> > =====
> Are you only getting errors from the attribute resolver?
> 
Yes.

> In ldap.properties, the idp.attribute.resolver.LDAP.bindDNCredential
> property is set from idp.authn.LDAP.bindDNCredential by default. So
> are you authenticating using LDAP & getting an error there too?
> 
In the ldap.properties file we have:

===
idp.authn.LDAP.bindDNCredential              = abc123
idp.attribute.resolver.LDAP.bindDNCredential =
%{idp.authn.LDAP.bindDNCredential:undefined}
===

If I assign the password directly to
'idp.attribute.resolver.LDAP.bindDNCredential' as well, we still get an
invalid credentials error.



John.

-- 
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK