IdPv3 LDAP password issue

[Negib A. Sherif]

I had similar experience getting Ldap error 49. If you are on IdP 3.x don't include baseDN after ldap port number in ldapURL line in ldap.properities file.  Ldap will fail and generate ldap error 49. Assign your baseDN to idp.authn.LDAP.baseDN line in the same file.

If you are in IdP 2.x watch out for symbols in ldap password that assigned to  principalCredential in attribute-resolver.xml file. For instance, if the password contains & symbol, Ldap will not authenticate because & is one of the 5 xml reserved characters and IdP is not passing the value . To fix it, one need to include an escape "amp;" (no quote)  before & symbol in ldap principalCredential password.

________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Friday, February 26, 2016 8:51 AM
To: users at shibboleth.net
Subject: Re: IdPv3 LDAP password issue

* John Horne <john.horne at plymouth.ac.uk> [2016-02-26 13:48]:
> On Fri, 2016-02-26 at 12:41 +0000, Naveed Hashmi wrote:
> > You could temporarily try a different/simpler pwd?
> >
> No, not really. The LDAP server, and same userid/password, is used by
> the live Shibboleth service. I do not have access to the LDAP server,
> so just creating a different userid/pwd is not possible unless I set up
> my own LDAP server.

Well, you could still create another DN in the LDAP server, with the
same permissions as the one currently used by the IDP, and give that a
simpler password. Just saying.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net